oh my god AGAIN?!
They gotta be trolling the entire linux userbase at this point.
I like a distro with problems that I can relate to.
Bad memory/routines? We have to be related. Since that feels like me.
some iconic duos in the Linux community: Arch and AUR malware, Ubuntu and bad updates, NixOS and community/team members leaving, Manjaro and failing to renew its cert.
Welcome to Linux, do you want the BenevolentDictatorOS, WeaponsManifaturerOS, MalwareOS or Debian?
WeaponsManufacturerOS is Nix, obviously (they’ve since dropped Anduril as a sponsor but we’re never going to let them live it down), MalwareOS I’m guessing is Arch, but what’s BenevolentDictatorOS?
AUR malware
Really, something like this ever happened lol?
I’m sure it has. The idea that it’s frequent is unhinged.
Wait…please tell me y’all heard of that crazy drama recently where there was tons of AUR packages getting infostealer malware added in.
They got a lot more cautious after that incident but… I’m less keen on the AUR now…
Edit: https://archlinux.org/news/active-aur-malicious-packages-incident/
Ubuntu and bad updates
This is the only drama in your list I’m not familiar with already. What/when did they last break?
Recently, the nvidia-dkms driver updates wouldn’t build for 5.x series kernels, so if you hadn’t cleaned up old kernels, the update bombed out before updating the initrd filesystem, the system couldn’t boot without intervention. Thankfully, I noticed before trying to reboot my work desktop, and the solution was “apt autoremove && apt upgrade”.
But the install media for my desktop at home was 18.04, and it’s running 26.04 now. It has an AMD GPU, so it hasn’t had update problems.
If your playbooks don’t include an autoremove, you’re doing it wrong!
Or rather, lessons learned from when the default /boot partition was only like 100 MB.
you forgot the oldest of them all, Debian and the its museum, their repos
Debian and shipping broken packages
deleted by creator
HOW THE FUCK DID THEY MANAGE IT AGAIN
They managed this again by not actually managing it… again.
They have embraced the meme
My first distro & my never again distro. Rest in piss, manjaro
Same here. I mean, Pop OS was technically my first, but I only used that for like 2 weeks and then switched to Manjaro.
Manjaro once again demonstrating they’re not a serious distro/project, hahaha
At this point, it’s a tradition!
Again??? Again???
BINGO!
In fact I got a full 5x5 card of bingo because I wrote “Manjaro doesn’t renew its cert” in all of the boxes.
This is literally why I stopped using Manjaro.
I’ve botched 2 Manjaro installs just doing a
pacman -Syuwhile their certs were expired and I ended up with an incomplete upgrade.Never once had this issue with EndeavorOS.
Look, I don’t want to call you a liar… so let’s say maybe you meant to say
pamacor got things wrong.Because:
- That’s not how
pacmanworks. If it hits a mirror with expired certs it just outputs a warning and uses another mirror. - On a fresh install Manjaro will compile an optical subset of mirrors for you based on location and response time. Those mirrors are spread around the world on different domains. It’s very unlikely that your list would include ONLY
mirrors.manjaro.organdmirrors2.manjaro.org. - But even if it did, and let’s say for the sake of argument there is a bug in pacman AND you got those mirrors… those two hosts are on a different certificate from manjaro.org (the website), are CNAME’d to
.rsc.cdn77.orghosts, get renewed automatically separately from the website cert, and have never been allowed to lapse afaik.
Maybe it wasn’t due to certs, but it still happened. That was enough for me to switch distros. I was much less experienced with Linux back then, so I wasn’t able to figure out how to get it working again.
So far I’ve daily-driven EndeavorOS, Mint, PopOS, and Kubuntu. None of them have broken themselves with an apt or pacman upgrade.
- That’s not how
Doesn’t happen with Antergos either.
I mean, I’ve gotten a NXDomain error ever since they shut down, but at least it’s not a certificate expiry!
Why isn’t this an automated processs for them?
Why isn’t this an automated processs for them?
Because
manjaro.orgis controlled personally by Phil, the CEO of the company, who’s paranoid about letting anybody else handle it. And also can’t figure out how to renew automatically, apparently. People have to remind him on Discord. 🤦Everything else
*.manjaro.org(forums, mirrors etc.) is handled by different people and have never expired afaik.It’s literally just the main webpage that has this problem, everything else about the distro is never impacted.
Why isn’t it for everyone? How often I see this with, I mean, major actors is head shakingly baffling.
I work in tech for telco and the amount of people around me who have zero clue about x509/TLS/certificates in general is absolutely baffling
I work in a telco and I have no clue what you just said to me.
But in tech?
Yes but with engines.
Well then you probably don’t encrypt a lot of network traffic…
You’d be shocked!
I wonder if they are still on an old cert system.
This came up last time the cert expired iirc.
Tl;dr one of the founders is holding up the infra not allowing any change. According to someone who worked on Manjaro, it was trivially easy to get this fixed, but that single person simply wouldn’t approve it. Last I checked they sent the founder an ultimatum: either hand over the project or see the staff walk. I suppose the staff walked.
I think you’re refering to this. The community appears to be in the process of setting up their own association and eventually the infrastructure and assets will be transferred to them. We’ll see how that shakes out.
Sad. With FOSS you have to be able to let go.
I’m shocked it even has any users tbh.
Well, Manjaro popped up when a lot of people cannot install Arch on their own. Same thing with Ubuntu and Debian. Once a userbase formed, people follow suit I guess.
I mean they have their own repos and take a position of “hardened updates” that are two weeks older than the bleeding edge ones of Arch. I used it briefly out of curiosity a couple years ago. It seemed generally fine, although I seem to remember having issues with some AUR stuff. That’s kinda to be expected and could even just be general fuckery on the part of the package maintainers, not manjaro. It could also be on manjaro’s fault lol.
I’ve just stuck to Arch since then. Garuda and endeavour OS are both cool but I don’t feel like I’m gaining much by using either. And Garuda includes a bunch of packages that I don’t even want.
I’m more interested in what manjaro can do in the mobile phone sphere. If they can build something viable yet fun to tinker with in the next few years that has a rolling release schedule, it could make for a cool Linux phone. Ubuntu touch is probably the more stable choice tbh, but that’s the beauty of Linux.
It was a selling point for Manjaro at some point but people really shouldn’t use AUR with it. That’s just an invitation to a disaster. I think Manjaro is stable if you don’t mix it with AUR. Used it for 6 years and the worst I remember was their Nvidia cataclysm, mostly it was fine.
Not sure if I would want to use cutting edge on mobile though. I tried PostmarketOS and Ubuntu Touch a couple years ago and Ubuntu Touch was actually daily drivable-ish. Really loved SXMO too, it’s a way different mobile experience.
The website cert is the one that expires. It doesn’t impact anything else about the distro. The package mirrors are on different hosts (and certs). It’s a good distro, wish they’d sort out the kerfuffle with the founder (who’s the one holding them back).
we know and no it is no good distro. fucking leechers
Honestly, I installed it on my 2nd laptop and workstation because I really wanted the AUR, but got tired of Arch unstable update process 15 years ago and left Linux for personal use for MacOS. It still has everything I want on my main laptop, home brew and a terminal with tmux.
It just works and I just couldn’t be arsed reinstalling, but yeah, if I would, I would just use Arch again now.
I use EndeavourOS (from Manjaro a lifetime ago) no complaints.
I’m also in the club of having a couple of Manjaro installs that now date back a few years to when it was still cool.
Honestly as a distro it works pretty well and my complaints are few. If I had to reinstall I’d take a closer look at CachyOS, EndeavourOS, or even just Arch, but I can’t really be bothered to replace something that’s working just fine so I’ll stick with it for now.
Manjaro is the worst of the most popular distros.
A little stability and consistency in the world, manjaro always delivers when it comes to this.
Like, when you… “get” the certificate… Doesn’t it say… “on it” exactly which date it expires? So maybe set a thing in your calendar or an alarm on your phone or some shit? How hard can this be?
LetsEncrypt also gives you a month to update certificate, you don’t even have to do it yourself, just run a script once a week in cron. That’s such a level of incompetence I wonder why anyone will trust them with a distro when they can’t even do such a simple task.
You could proactively take care of it with a reminder on the calendar. Or alternatively, just let the community inform you when you need to renew it. Both are effective methods.
They use LetsEncrypt. There is literally a bot you can install to automate the renewal process daily on a cron schedule and notify you if it fails.
They’re just fucking morons managing the infra for their domain.
Yes there is an easy fix that will make the problem go away. At this point you know it’s deliberate.
I personally think it’s hilarious.
The second alternative is a bit of a gamble with trust though eh 😅
Since I have never used the distro but have seen threads like these popping up every time the cert expires, I don’t think it takes much trust.
Also it’s pretty fucking hilarious.
It really is starting to become pretty laughable.
Holy shit this is so stupid I can’t defend them anymore 😂😂
I thought this was an anniversary of a funny event that happened one time type of meme. But no. It has happened NINE TIMES, including today.
