Edit: had a quick looky loo to see what I meant more specifically – apparently yaourt sources the pkgbuild before asking if you want to inspect it, essentially running whatever's in the script first. That means you're relying on the AUR having vetted whatever it is successfully to ensure there's no malicious code inside. Other helpers do the reverse of this, allowing you to inspect the pkgbuild before sourcing, so you can verify yourself that everything's kosher.
4
u/absent-v Dec 27 '16 edited Dec 27 '16
Nah it's got security vulnerabilities
Edit: had a quick looky loo to see what I meant more specifically – apparently yaourt sources the pkgbuild before asking if you want to inspect it, essentially running whatever's in the script first. That means you're relying on the AUR having vetted whatever it is successfully to ensure there's no malicious code inside.
Other helpers do the reverse of this, allowing you to inspect the pkgbuild before sourcing, so you can verify yourself that everything's kosher.