[0xbadcafebee]

Two security incidents over decades is proof that distros are more secure, not less. Every other system for distributing software has weekly security issues.

> what package distribution mechanisms actually provide in terms of guarantees

1) Mirrors of cryptographically signed files to verify integrity (both the source code and the built packages), 2) a secure software supply chain & SBOM, 3) reproducible builds (for some distros), 4) humans independent of the authors vetting admittance of new packages to prevent obvious malware, 5) stable branches of packages that work together (preventing need to constantly upgrade, a source of new vulnerabilities), 6) backported security patches (necessary if you can't upgrade), 7) package maintainers fixing glaring security holes in the default installation methods of software to prevent the distro from having new vulnerabilities.

[woodruffw]

To be clear, the RSA key thing isn’t really about it being a security issue — that’s a part of it, but the bigger point was that it reflects structural failure/inertia that’s commonplace in distribution packaging.

(I am not a hater of distribution packaging, either. But I typically find comparisons between it and language packaging lacking, because the two have very different trust topologies.)