By having reputable sources. And most likely having people reviewing upgrades, what you're installing and what the building code is doing (and running it in a s

By having reputable sources. And most likely having people reviewing upgrades, what you're installing and what the building code is doing (and running it in a sandbox). This role is usually taken by the distribution's packagers. As some kind of users cooperative, distribution have very distinct incentives from software vendors. This separation has been eroded with the advent of self-publishing "app stores" (like the commercial ones, but also by npm, pypi, crates.io etc, and by flathub or snapcraft). See [1] and [2] from DeVault on this topic. This topic has been solved, it just needs manpower. And just because major distributions have some perceived bureaucratic overhead doesn't mean it's an intrinsic caracteristic. Official repos on arch, alpine and probably tons of other distribs are actually updated really quick and really simply (and still sometimes have patches applied to them, or support files, etc). [1] https://drewdevault.com/2019/12/09/Developers-shouldnt-distribute.html https://drewdevault.com/2019/12/09/Developers-shouldnt-distr... [2] https://drewdevault.com/2021/09/27/Let-distros-do-their-job.html https://drewdevault.com/2021/09/27/Let-distros-do-their-job.... PS: These aren't "terrorist attacks". It's quite emotional, judgmental and not very precise nor meaningful. Some random dude pushed malware in a supply-chain attack. From wikipedia on terrorism: > Having the connotation of "something morally wrong", the term "terrorism" is often used to abuse or denounce opposite parties, either governments or non-state groups. > It is common for both parties in a conflict to describe each other as terrorists.