5 ms·

Definitely try an Arch-based distro. I run Arch myself, but I've heard good things about Manjaro.

henriquez 6y ago
Doesn’t arch also allow arbitrary package upgrades straight from the developers? Again I’m pretty ignorant but my impression looking at it previously was there isn’t any sort of “peer review” by repo maintainers.
- Sevaris 6y ago
  You're never forced to update. I'm don't even think Arch natively supports automatic updates. You can also tell pacman to skip a package from being updated if you're aware of a problematic update but you want to update the rest of your system. And yes, Arch takes in the upstream vanilla packages, though there are testing phases before updates reach stable repos. I'm not sure any of this is a bad thing. It also means you don't have to wait 6-12 months for the newest version.
  - dathinab 6y ago
    I think what he/she means is that core maintainers (or AUR maintainers) might be able to change a package without another core maintainer (or AUR maintainer) reviewing it.
    - Sevaris 6y ago
      Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD (because no, it isn't verified by anybody). At the very least, you need to be checking where the package is being downloaded from.
      - dathinab 6y ago
        The PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.
        deleted 6y ago
        [deleted]
- dathinab 6y ago
  Arch is kinda the I can do everything reliably distros if you know how to set me up. Updates are only installed when you run pacman (or a pacman wrapper/replacement). But I guess you mean changes to a package in the repository with "package upgrades straight from the developers". There are two sources for arch packages: - The official repository, - The AUR repository The later one does indeed allow maintainers to arbitrary update or remove packages. It provides just a way for _users_ to provide custom packages to other users. The responsibility for reviewing them lies with the person using them. This is clearly communicated. Also most AUR packages do not contain any code but just install instructions which pull the code/binaries from their original source (e.g. github/github releases/the website of the project for which the package is). So reviewing them is normally quote doable. The only annoying to review AUR package I can remember is tor-browser. With regard to the official package thinks are actually pretty similar as far as I know (but I don't rally know) except that not everyone can publish thinks there and you have a group of "trusted" core maintainers. In the end arch is a distro by the "experienced" Linux user for the "experienced" Linux user without to much financial backing. Not that there still are thinks like a security group which tracks CVE's and similar but it's fully based on volunteers. This makes it quite a fascinating choice as any choices wrt. maintenance comes from some dev wanting to use it on their system. But yes if you don't trust the core maintainers don't use it. Also it might not be appropriate to be used on cooperate systems due to company policies wrt. legal liability reasons. Still you also trust many other software maintainers solely based on a good reputation and for arch it's in the end the same. Also besides pacman and probably some other minor thinks Arch doesn't do any code. It's just provides code other people wrote (sometimes with publicly known patches) to the user, sometimes pre-compiled.
- nsajko 6y ago
  > Doesn’t arch also allow arbitrary package upgrades straight from the developers? No. > “peer review” I am not sure what you mean, and I don't know that much about Arch developer and Arch maintainer protocols; but the whole thing is more transparent than Debian: everything, including the PKGBUILDs and the rare patch is accessible through public git repos very accessibly and visibly linked from the web page of each Arch package. Debian also has public git repos AFAIK, but finding them and navigating the directory hierarchy is more difficult.
SweetestRug 6y ago
Manjaro is simply fantastic. I switched when upgrading Ubuntu failed again. Hardware detection is great, defaults are sane, and pacman is a great package manager. The AUR is also amazing.

Doesn’t arch also allow arbitrary package upgrades straight from the developers? Again I’m pretty ignorant but my impression looking at it previously was there isn’t any sort of “peer review” by repo maintainers.

Sevaris 6y ago
You're never forced to update. I'm don't even think Arch natively supports automatic updates. You can also tell pacman to skip a package from being updated if you're aware of a problematic update but you want to update the rest of your system. And yes, Arch takes in the upstream vanilla packages, though there are testing phases before updates reach stable repos. I'm not sure any of this is a bad thing. It also means you don't have to wait 6-12 months for the newest version.
- dathinab 6y ago
  I think what he/she means is that core maintainers (or AUR maintainers) might be able to change a package without another core maintainer (or AUR maintainer) reviewing it.
  - Sevaris 6y ago
    Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD (because no, it isn't verified by anybody). At the very least, you need to be checking where the package is being downloaded from.
    - dathinab 6y ago
      The PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.
      - deleted 6y ago
        [deleted]
dathinab 6y ago
Arch is kinda the I can do everything reliably distros if you know how to set me up. Updates are only installed when you run pacman (or a pacman wrapper/replacement). But I guess you mean changes to a package in the repository with "package upgrades straight from the developers". There are two sources for arch packages: - The official repository, - The AUR repository The later one does indeed allow maintainers to arbitrary update or remove packages. It provides just a way for _users_ to provide custom packages to other users. The responsibility for reviewing them lies with the person using them. This is clearly communicated. Also most AUR packages do not contain any code but just install instructions which pull the code/binaries from their original source (e.g. github/github releases/the website of the project for which the package is). So reviewing them is normally quote doable. The only annoying to review AUR package I can remember is tor-browser. With regard to the official package thinks are actually pretty similar as far as I know (but I don't rally know) except that not everyone can publish thinks there and you have a group of "trusted" core maintainers. In the end arch is a distro by the "experienced" Linux user for the "experienced" Linux user without to much financial backing. Not that there still are thinks like a security group which tracks CVE's and similar but it's fully based on volunteers. This makes it quite a fascinating choice as any choices wrt. maintenance comes from some dev wanting to use it on their system. But yes if you don't trust the core maintainers don't use it. Also it might not be appropriate to be used on cooperate systems due to company policies wrt. legal liability reasons. Still you also trust many other software maintainers solely based on a good reputation and for arch it's in the end the same. Also besides pacman and probably some other minor thinks Arch doesn't do any code. It's just provides code other people wrote (sometimes with publicly known patches) to the user, sometimes pre-compiled.
nsajko 6y ago
> Doesn’t arch also allow arbitrary package upgrades straight from the developers? No. > “peer review” I am not sure what you mean, and I don't know that much about Arch developer and Arch maintainer protocols; but the whole thing is more transparent than Debian: everything, including the PKGBUILDs and the rare patch is accessible through public git repos very accessibly and visibly linked from the web page of each Arch package. Debian also has public git repos AFAIK, but finding them and navigating the directory hierarchy is more difficult.

SweetestRug 6y ago

Manjaro is simply fantastic. I switched when upgrading Ubuntu failed again. Hardware detection is great, defaults are sane, and pacman is a great package manager. The AUR is also amazing.