Comment on Manjaro Linux Team Goes on Strike, Threatens to Fork the Project

• chronicledmonocle@lemmy.world ⁨14⁩ ⁨hours⁩ ago

  It’s more than that. Broken updates. Failed hardware ventures. The project has been shambling along for a long time.

  source

  • nymnympseudonym@piefed.social ⁨12⁩ ⁨hours⁩ ago

    and the certs lapsed again after volunteers built tooling to Prevent That

    but somebody never set up the cron job to run it

    source

    • MalReynolds@slrpnk.net ⁨11⁩ ⁨hours⁩ ago

      Well that’s confidence inspiring.

      source
  • vaionko@sopuli.xyz ⁨6⁩ ⁨hours⁩ ago

    Don’t forget their package manageer DDoSing the AUR multiple times

    source

    • harmbugler@piefed.social ⁨25⁩ ⁨minutes⁩ ago

      You seem to have misspelled package mangler

      source
    • chronicledmonocle@lemmy.world ⁨1⁩ ⁨hour⁩ ago

      Oh yeah. Forgot about that one.

      source
• exu@feditown.com ⁨8⁩ ⁨hours⁩ ago

  I think it’s actually 3 now. IIRC they did it again last year

  source
• victorz@lemmy.world ⁨12⁩ ⁨hours⁩ ago

  Could you please explain why not renewing their certs is such a serious betrayal? Like, if they fixed it, isn’t that okay? And even if it happened again, and they fixed it again, isn’t it human to err? Or why is it such a harsh offense?

  Serious question, I don’t know the consequences of not renewing these certs. 😊

  source

  • Addv4@lemmy.world ⁨12⁩ ⁨hours⁩ ago

    It’s the tls certificate that proves your website is legit. Without which, you can potentially be a malicious actor that can pose as the website, and when you download the iso, you could unknowingly download something malicious. It’s pretty hard to forget certificate renewal (most of the time there are plenty of reminders sent and warnings given), so the fact that it happened twice was very impressively bad.

    source

    • dubyakay@lemmy.ca ⁨11⁩ ⁨hours⁩ ago

      It’s pretty hard to forget certificate renewal (most of the time there are plenty of reminders sent and warnings given)

      Oh boy. Seems to be the opposite in real life. Especially when it comes to managing stored cert of businesses partners. It has gotten somewhat better now of course, but three years ago most of my company’s sev1 production issues were due to lapsing or unscheduled cert changes.

      source

      • arsCynic@piefed.social ⁨11⁩ ⁨hours⁩ ago

        Can confirm it happens often here too indeed.

        source
  • rhubarbe@tarte.nuage-libre.fr ⁨8⁩ ⁨hours⁩ ago

    People are very harsh with Manjaro. There’s more than just a list of objective facts unfortunately. I suppose there were some bruised egos at some point.

    The certs issue wasn’t a big deal, it didn’t change anything for me as a user. It just paints a bad image.

    source

    • daggermoon@piefed.world ⁨5⁩ ⁨hours⁩ ago

      As a former Manjaro user, it has some issues. It has weird bugs that aren’t present in any other Arch-based distro. Pamac ddosing the AUR is pretty bad as well. I’m thankful I used it as long as I did though. It got me hooked on Arch based distros. Everything else feels antiquated now. Actually, Void Linux is kinda cool

      source
  • underisk@lemmy.ml ⁨11⁩ ⁨hours⁩ ago

    it’s the main way for software to verify the identity of a source. without it you let nefarious actors do something like hijack a DNS server and impersonate your servers to your users, which is a pretty big problem if you’re running a software distribution network! it is literally a breach of trust and massive security vulnerability. and it probably broke a ton of shit when software that uses the certificate found an expired one and suddenly (and correctly) refused to work.

    source