Hacker News Reader

Adding the usual disclaimer that yay is an AUR helper and thus not officially supported by Arch. Arch users are advised to read https://wiki.archlinux.org/index.php/Arch_User_Repository instead. If you know what you're doing, of course using yay should be fine as well.

View on HN

It should be noted that adding a PPA is equally unsupported, so in both cases you're trusting a third party.

Despite all the disclaimers (or perhaps because of them), the AUR is IMHO one of the more safe and well-thought-out ways of including third-party stuff. It's relatively simple to verify that the package is installing what it says it is, because you can check the PKGBUILD file, which is short and simple to read. I would have no idea how to go about verifying that a .deb file was what it said it was.

`dpkg -L filename.deb` provides a list of files to be installed.

Reply on news.ycombinator.com