[sandov]

it's not fundamentally different.

The practical difference is that the ecosystem of Linux applications is composed almost entirely of open source software. Consequently, installing something you downloaded from the web is much less dangerous than installing a closed source program on Window, provided that you trust the website.

I agree that the centralized scheme is easier to use in the 80% of cases. i.e. when:

(1) The package you want is in the repos, and ... (2) The version of the package you want is in the repos.

But, when those 2 conditions are not met, installing software is usually harder than on Windows. Additionally, I don't like the very nature of centralized things, even if they are managed by the good guys.

[stewbrew]

Unless somebody else built the app from source and reproduced exactly the same binaries there is no guarantee that the binaries you download were actually built from the source you're looking at. Open source per se doesn't magically imply any benefits wrt security. Things look differently if the binaries were built on a central & trusted platform or by trusted packers.

[sandov]

> Things look differently if the binaries were built on a central & trusted platform or by trusted packers.

How so? I believe the same principle applies for centralized distribution. How do I know the packer didn't change the code?. The same way I trust repo mantainers I can trust application developers, or any other third party.

And reproducible builds are possible both in decentralized and centralized modalities of distribution. Aren't they?

[deviantfero]

Yeah I agree that it is a pain when a package is not in the official repos and maybe I should see this a centralized solution to that, currently I think each distro tries to solve it somewhat, for example Arch and it's AUR