In thread Malicious AUR Checkup Script @1093i3511 and I had a discussion about what is one of the main problems in AUR that the Arch team should address, because it has simply turned out to be a fatal flaw in two respects, and we, as Arch users—or at least as Endeavour users—should definitely start something like a petition or something similar so that something actually gets done about it.
For one thing, there are far too many orphaned packages. These were the main targets in the first wave of attacks on the AUR. In our opinion, they should be deleted. One way to handle this would be to flag them for deletion after they’ve been orphaned for a certain period, and then, after a shorter period, delete all those for which no one has come forward to explicitly take over as a maintainer. Of course, that won’t happen, but it could. Second. User registration. @1093i3511 mentioned that currently, only a fraction of AUR users are actually registered. This must become the standard. No registration, no access to the AUR. Period. We should vehemently demand these two things from AUR-Users, at first as EOS users, but then later as Arch-Users.
This complete lack of accountability has led to utter chaos, and leaving everything to the whims of AUR users who aren’t even registered is no longer acceptable. Mandatory registration must be enforced without exception; otherwise, the next mess will start all over again tomorrow, and Arch will lose users left and right. Maybe not us, but there will be an exodus if the regular AUR is truly that chaotic and such attacks occur regularly.