Why must we have an "us and them" attitude to distributions, instead of helping to make them better? Free Software does not guarantee against nefarious third p

Why must we have an "us and them" attitude to distributions, instead of helping to make them better? Free Software does not guarantee against nefarious third party manipulation. But it does guarantee that you can study the code that is running on your system. Debian goes to great lengths to make sure that the binaries you get really can be built from the sources claimed (eg. random binary blobs embedded in source trees are not acceptable). What users do next is up to them, but I think Debian is an example of the best we have. We are really better off gathering around open projects like Debian, than slating it for what it is. It seems to me that the root cause of this "botching" is of not enough (qualified) eyes and hands working on making the code base better; if the upstream OpenSSL project had a decent, best practice, well commented code base with no build time warnings, no spaghetti code and decent test suite coverage, then no "botching" would have happened. I think we have the best framework for fixing this problem: Free Software and Free Software distributions. What we should be talking about is how to make things better within this framework. And this just comes down to hard work, which everybody seems to expect somebody else to be doing. I find it very difficult to accept the critics who are happy to use OpenSSL but also are not committing any resources to making it better. If the NSA really were the only major contributor to a Free Software project, then sure - they'd own it.