since the 2022 grub incident, Arch has done a great job at notifying the news channel when "manual intervention required" AFAIK, and I don't remember any instances of Arch maintainers only notifying Reddit (and I don't think they notified Reddit for the grub incident either lol).

They are actually putting a message on the regular news feed about the AUR! https://archlinux.org/news/active-aur-malicious-packages-incident/ As it should be. It just took a bit too long in my opinion, as discussions are going on since yesterday.

Yes, definitely not foolproof. This is more of a wake up call to be at least careful and reconsider every single AUR package one has installed. For me, I was lucky too. But in my case it wasn't pure luck that the few AUR packages I have installed aren't affected. See, because since years using the AUR (sparingly! including my own package :D ) I always feared off orphaned packages and removed them as soon as I could. This incident here is proof I was right.

For some stuff I also prefer the Flatpak, because I do not trust everyone on the AUR, as they operate on root rights! When I brought this up on Endeavor, they disliked my opinion (as a fresh user) and the trusted community members there explained to me that the AUR is way more safe than Flatpak, because there is a trust system of upvotes and everyone can flag the packages, and that Flatpak has a wrong sense of security. That is what they told me and totally ignored my issues with AUR... one of the reasons why I do not visit the EndeavourOS community... I digress...

I am gonna get a lot of hate for this but the AUR flaws are hidden behind a legal warning of “At your own risk”. They just don’t want to take the legal consequences for this. That’s why there are basically 0 preventive measures for detecting bad actors and preventing malicious attacks.

I can think of some solutions:

1. If a package is orphaned then let a potential maintainer just fork it and flag the original for deletion. So the user who has actually installed the old package and want an update will manually go out looking for the updated one instead of just doing a yay -Syu one day and getting malware on the system.
2. If the developer and maintainer are the same for an AUR package, let them maybe add a ArchWiki style captcha, whose output can be added to the upstream repo like in .aurverification file, which can be detected by AUR when putting in the upstream repo URL and the maintainer must verify with that captcha every 6 months or so just to prove active development. If they fail to do so, mark the package as abandoned or unverfied.
3. Newly created accounts will have a cooldown of a week to add a new package to the AUR (I don’t know if this exists already as I haven’t looked into it). And they can only create one repo in a month until a year has passed. They can takeover or fork orphaned packages only after a year and if they are maintaining at-least one repo of their own.

I disagree with the post you put here on a single thing: the manual is sometimes bad, by either not describing everything, or being unclear.

OpenSuSE also comes in two flavours, Leap (a stable release) and Tumbleweed (which is rolling release and sligthly less bleeding edge than Arch).

You can even run Opensuse stable, and in a VM on top Tumbleweed to have a system where you can safely try out new stuff.

Have you heard about the recent fuckups of fedora? fedora is a shitshow.

Oh really? I guess I haven't. 😬

Yeah it was late here so I think I was poorly mushing two separate thoughts together there. I meant I was thinking of moving to a distro that isn't as bleeding-edge for the laptop I'm not updating every single day...But also I should find something that still has a nice large software variety so I stay off AUR.

OpenSUSE has the "Open Build System" which I've used for like one package. So that's pretty neat.

This is really tough because I have two gamers in the family using Nvidia cards I want to help move off of Windows, but I don't want them running into having to roll back as often as I have or fiddle too much, but I feel like Mint is a little too far behind.

So I was considering the KDE spin of Fedora for them...But yeah, the answer isn't so easy anymore lol.

Could you elaborate wrt Fedora being a shitshow? It's my daily driver and I haven't experienced any kind of instability and (to my knowledge) I have not been compromised.