lol that's my favorite web browser

I think you're refering to this. The community appears to be in the process of setting up their own association and eventually the infrastructure and assets will be transferred to them. We'll see how that shakes out.

I work in tech for telco and the amount of people around me who have zero clue about x509/TLS/certificates in general is absolutely baffling

Look, I don't want to call you a liar... so let's say maybe you meant to say pamac or got things wrong.

Because:

1. That's not how pacman works. If it hits a mirror with expired certs it just outputs a warning and uses another mirror.
2. On a fresh install Manjaro will compile an optical subset of mirrors for you based on location and response time. Those mirrors are spread around the world on different domains. It's very unlikely that your list would include ONLY mirrors.manjaro.org and mirrors2.manjaro.org.
3. But even if it did, and let's say for the sake of argument there is a bug in pacman AND you got those mirrors... those two hosts are on a different certificate from manjaro.org (the website), are CNAME'd to .rsc.cdn77.org hosts, get renewed automatically separately from the website cert, and have never been allowed to lapse afaik.

Why isn’t this an automated processs for them?

Because manjaro.org is controlled personally by Phil, the CEO of the company, who's paranoid about letting anybody else handle it. And also can't figure out how to renew automatically, apparently. People have to remind him on Discord. 🤦

Everything else *.manjaro.org (forums, mirrors etc.) is handled by different people and have never expired afaik.

It's literally just the main webpage that has this problem, everything else about the distro is never impacted.

I mean, it happens every 3 months when the LE cert expires...

They actually do... He never does it, for some reason...

The website cert is the one that expires. It doesn't impact anything else about the distro. The package mirrors are on different hosts (and certs). It's a good distro, wish they'd sort out the kerfuffle with the founder (who's the one holding them back).

Maybe it wasn’t due to certs, but it still happened. That was enough for me to switch distros. I was much less experienced with Linux back then, so I wasn’t able to figure out how to get it working again.

So far I’ve daily-driven EndeavorOS, Mint, PopOS, and Kubuntu. None of them have broken themselves with an apt or pacman upgrade.

I found myself trying to install upstream Arch packages.

You realize that's how you broke, right? It's like installing Debian packages on Ubuntu.

It relied on AUR some, which also messed things up.

How does it rely on AUR?

3rd party repos or AUR didn't work, as its not in sync with upstream arch.

What 3rd party repos?

AUR works perfectly fine.... when it works. AUR is a mess of its own. It's chock full of malware as we speak and it's not accepted as a reference on Arch or any other Arch-based distro. Saying an Arch distro "doesn't work with AUR" is completely irrelevant at the best of times.

Not to mention the cert thing. Manjaro really did let certs expire many times. When I was new to linux, that took me forever to figure out.

Did you spend a lot of time reading the webpage, or?... Because that's the only cert that expires, the mirros and the forums never did. What exactly were you figuring out?

Whoa nellie.

This was many years ago, when I didnt know much about linux, and yes many lessons were learned. Though I distinctly remember instances where I couldnt update Manjaro packages because of expired certs.

To clarify some points:

• On packages/AUR, I was desperate, because upstream Arch had some critical fixes that werent shipped to Manjaro yet. Clearly this didnt work out well.

• AUR specifically breaks with Manjaro because AUR targets upstream arch as a base. When a dependant Arch package updates, the AUR package immediately updates to that new dependecy if its being maintained. But since Manjaro delays the upstream updates, this AUR package will break if its updated.

• Yes, I know AUR is filled with malware now.

My first distro & my never again distro. Rest in piss, manjaro

AUR specifically breaks with Manjaro because AUR targets upstream arch as a base. When a dependant Arch package updates, the AUR package immediately updates to that new dependecy if its being maintained. But since Manjaro delays the upstream updates, this AUR package will break if its updated.

Again, using the AUR as the standard for evaluating any Arch-based distro is really not cool.

Leaving that aside, the exact thing you've mentioned can happen on vanilla Arch, if the AUR package you are trying to install is based on Arch packages that you haven't received yet. So you'd have to upgrade your system every time you're trying to update or install an AUR package to be sure.

since Manjaro delays the upstream updates, this AUR package will break if its updated.

It won't break, it will either succeed compiling or not with the older packages. If it succeeds, no harm done. If it doesn't, you still have the previous version.

The unlikely corner case is that the new AUR package version relies on new API/features that only exist in newly released Arch packages and you absolutely must have the latest version right now. But then you're using the wrong distro for that.

I was desperate, because upstream Arch had some critical fixes that werent shipped to Manjaro yet.

Manjaro ships critical updates out of band, without waiting for regular batch updates.

we know and no it is no good distro. fucking leechers

I have no idea either

Nginx as well

AUR malware

Really, something like this ever happened lol?

If your playbooks don't include an autoremove, you're doing it wrong!

Or rather, lessons learned from when the default /boot partition was only like 100 MB.

I'm sure it has. The idea that it's frequent is unhinged.

Same here. I mean, Pop OS was technically my first, but I only used that for like 2 weeks and then switched to Manjaro.

And @rotten@lemmy.today

Wait...please tell me y'all heard of that crazy drama recently where there was tons of AUR packages getting infostealer malware added in.

They got a lot more cautious after that incident but... I'm less keen on the AUR now...

Edit: https://archlinux.org/news/active-aur-malicious-packages-incident/

Its intended behavior from Debian team. because they ships a version of the software at the time and only backport security patches. So if the version they ship has bugs then those bugs stay for years. This generates quite a bit of noise for upstream projects but it is what it is.

I thought this was an anniversary of a funny event that happened one time type of meme. But no. It has happened NINE TIMES, including today.

I work in a telco and I have no clue what you just said to me.

Manjaro is the worst of the most popular distros.

But in tech?

WeaponsManufacturerOS is Nix, obviously (they've since dropped Anduril as a sponsor but we're never going to let them live it down), MalwareOS I'm guessing is Arch, but what's BenevolentDictatorOS?

Yes but with engines.

Well then you probably don't encrypt a lot of network traffic..

You'd be shocked!

it may be broken... but at least it's stable