[woodruffw]

Being unable to rotate the same weak RSA key for over a decade because it was too operationally cumbersome[1] does not strike me as “modern best practices.” I also don’t think any Linux distribution package maintainer would make a legally binding claim to have “vetted” packages: the filter is reputational, not a strong guarantee that the package is not malicious. The xz incident demonstrates that tidily: the only reason it was caught it because it was noisy; the package itself was presumed to be safe.

(This is, to be clear, fine. But we should be clear-headed about what package distribution mechanisms actually provide in terms of guarantees.)

[1]: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1461834

[0xbadcafebee]

Two security incidents over decades is proof that distros are more secure, not less. Every other system for distributing software has weekly security issues.

> what package distribution mechanisms actually provide in terms of guarantees

1) Mirrors of cryptographically signed files to verify integrity (both the source code and the built packages), 2) a secure software supply chain & SBOM, 3) reproducible builds (for some distros), 4) humans independent of the authors vetting admittance of new packages to prevent obvious malware, 5) stable branches of packages that work together (preventing need to constantly upgrade, a source of new vulnerabilities), 6) backported security patches (necessary if you can't upgrade), 7) package maintainers fixing glaring security holes in the default installation methods of software to prevent the distro from having new vulnerabilities.

[woodruffw]

To be clear, the RSA key thing isn’t really about it being a security issue — that’s a part of it, but the bigger point was that it reflects structural failure/inertia that’s commonplace in distribution packaging.

(I am not a hater of distribution packaging, either. But I typically find comparisons between it and language packaging lacking, because the two have very different trust topologies.)