> Me. Who reads the source code of every program they run?
No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things.
You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.
Thank you for explaining, since in the year-plus of using Arch that has never been shown in a tutorial or in the OS itself. "paru <package>" is all I've known, and the AUR wiki makes it sounds like 15 steps of compile from source.
Have been reading source code for over 15 years now. I read the source code of a lot of software, just for curiosity's sake. I go out of my way to read the source code of random scripts I find laying about and that I want to run, and I do so before running them. PKGBUILDs are in that category, as are random scripts people throw on GitHub.
Only difference is now I ask AI models to read the source too. Chances of malware slipping by both myself and AI is lower than it slipping by either in isolation.
I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.