Post #4070291
2026-07-24 19:03 UTC
Replies (2)
-
@incentive@mastodon.circlewithadot.net 2026-07-24 19:05
@finn@social.0x520.eu If you don't have a need for bleeding edge at the base, you should be fine to do what you want. Depending on the age of your hardware I'd probably check to make sure the kernel version in Debian supports everything on that end too. If you stay on Arch, you don't need the AUR really. Flatpaks are usually available, and distrobox is also useful if you want an app version from a specific distro.
-
@SpacingBat3@101010.pl 2026-07-25 08:43
@finn@social.0x520.eu I would be more wary of Debian personally: isn't adding PPA's (or any of numerous repos some people blindly add) a similar risk? I also think it might be a quietter attack vector, given such repositories aren't really that much centralised as AUR, so it might be harder to pinpoint it or have consolided analysis. They also provide binaries/prebuilt packages, making them that much harder to analyze. But of course AUR also have orphaning system, which might allow to easier take control of something that was previously safe. But again, AUR's never been considered as safe to begin with. I think AUR's got also louder, among other reasons, because of how it is being centralized, hence it is easier to blame it. If people were to share viruses on literally every other random page and it were common practice to add this to your system, who or which service could you blame? With that being said, I think you should consider *safety* of community-maintained repos as last factor for picking distro: since those are bound to be less trustwothy and requiring some kind of constant analysis than blindly adding them as software provider in the end. At most, you might check how packages are attested and if package manager guarantees cryptographical security of packages you get from trustworthy repos, which tends to be norm but is still worth getting familiar yourself with, especially when picking less popular distros. Debian choice vs Arch was always between whether you want rock-solid LTS-alike software experience vs bleeding-edge latest stable software distribution, anyway. And I hope it'll remain of more philosofical differences between maintenance and implementation of software distribution between these projects than other stuff. 🙂