But the orphaned packages in the official repo can't be adopted by just about anyone

It also makes the impression that linux are insecure and prone to malware, backdoor, and all sort of nasty stuff. Things that are relevant in the current time of people moving away from windows. The AUR news too is making it seems like AUR is a primary repo for many of arch packages

Tantacrul, (I think) the lead of the Audacity (and also the guys that lead Muse Score) said that V4 is migrating everything first to QT. After that, they will start adding more features and also fix more backwards compatibility to the old engine (because V4 will also introduce new engine)

Keepassxc is even better in that regard. You can upload your database to backblaze for example or really any other cloud storage because the database is stored encrypted

I really truly wish more framework do it this way. But it is understandable most didn't do it this way because the web standard was lagging behind than what the user needs. Bootstrap, jquery, tailwind, and many others already existed and provided a solution for dark theming before the media query even exists.

By installing another bootloader and make the UEFI entry for it. I don't use a bootloader at all tho and just straight up register the linux kernel using efibootmgr

Great write up about the effect of LLM and first point of contact. It still needs to be said however that sometimes the question itself already has an answer and it is buried deep in the other noise. What we can do is make a place that like stackoverflow but without the toxicity

Plus one to this. I'm happy with typst but the op is asking for latex. Typst is an alternative to latex not another compiler

Cheaper to build and maintain probably. You can dock a ship for a while but you need to bring manpower to a platform

Sure, your proposed solution is a good way to weed out the low hanging fruit. But I don't like that it may create friction for normal users. AUR was never meant to be a FOSS project on its own with a full time maintainer that maintains PKGBUILD and the infra.

Like I said before, it is more akin to an internet forum and pastebin more than a full fledged package repository. And to be fair, it isn't a package repo anyway. It's like a cmake / makefile sharing site. Building and packaging for arch is just that easy compared to say, debian.

If people want to use a repo, there is chaotic aur. Maybe that could be the way too. A dedicated community project to vet the AUR. Or the project maintainer itself could provide a pkgbuild directly on their repo.

Just don't ever blame the maintainer for providing a place to store something for free and open to anyone. Especially if it is your choice to get something from said place and be surprised that it is malware.

You said it yourself that it is a community repository. No difference between that and the internet forum. You are putting the burden of accountability on the maintainer that way. Which I would remind you, is unpaid unlike say, github and npm that HAS a financial means to do a lot of security implementation. Yet those platforms still fail to do it.

Also, humans ARE the first layer of defense. Because anything you do on your device (on linux anyway, and specifically arch) is YOUR decision. Antivirus and everything else should kick in when the human fails.

You are normalizing people downloading things off the unvetted internet like on windows. Linux has a vetted repo already. THOSE are what people should be using and I'm fine with if those are being blamed. Everything else is USER due diligence. That is why the existence of easily installing malware like limewire does not justify blaming the platform. Or do you also blame torrenting site when they are chock full of malware?

Or maybe don't use AUR blindly? You're doing the equivalent of `sudo curl

| bash`. Who knows what the script is doing. So only do it if you truly trust it. That's why we have warnings plastered all over. That's also why a warning label and sticker exists. And this is precisely the reason easy no user input AUR helpers are greatly discouraged