Post #4693885 · Elektrine

2026-09-14 18:24 UTC

They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that) Some people do an astounding amount of work. And then there are many, many, which help a little. Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.

Replies (1)

@klankin@piefed.ca 2026-09-14 21:14

Oh god yeah, its just filtering through the slop that actually matters. But like the XZ trojan that was only affecting Debian installs, each distro needs to individually have competent maintainers to ensure their store is safe. If for exapmle I set a couple ‘bugfixes’ in the guix package file for emacs, I could reasonably infect a number of systems if a lazy maintainer just approved the request. (Or other attacks without even involving guix if I notied a bug in a package spelling and typo squatted it, or stole signing keys and pushed updates to the repo myself). None of these would change anything to other distros maintainers, but because this distros AI maintainer could risk a large number of users devices.

Open ##4693884