a third party has independently verified and attested to the quality or state of x software. If I use an application, I enter a trust relationship with the ven

a third party has independently verified and attested to the quality or state of x software. If I use an application, I enter a trust relationship with the vendor of that application. I don't want a third-party to make random decisions like adding pile of unsupported patches to the software or deciding that I cannot have it because it is `unethical` (which usually means non-FLOSS). Moreover, you are often stuck with old versions that have known bugs, because they refuse to update packages in LTS versions. Moreover, I think the verification is overstated. Most package maintainers do not have the competency and/or time to conduct a security audit or review deltas between releases. I have been involved with some distributions and a lot of maintainers just check whether a new version still builds. If it doesn't, in the best case they know what they are doing, in the worst case they'll take random patches from the internet until it works. I would rather trust whoever made the application. They know their own software well and have a high stake in distributing something that works as expected without large regressions. The Linux distribution model is fundamentally broken for desktop operating systems. The turnaround time is slow, there is no proper isolation between the operating system itself and its applications, and there is a barrier between the user and the application developer (who usually don't support old, patched versions for a reason). The model for a modern desktop Linux would be a stable, reliable core, with desktop applications provided as bundles through a platform where malicious applications can be yanked (something like Flathub or the Mac/iOS app store). Luckily, some distributions are open to newer models. E.g. Fedora Silverblue uses a lean, immutable OS, managed through OSTree and Flatpaks on top.