What other distros have you played with recently?

[Hoser Rob]

To be honest I find XFCE something from the past. ...

I understand what you're saying but that doesn't faze me a bit. OS X is based on Unix, as is Linux. The OS X kernel isn't identical to Linux ... I think it was originally based on the Mach kernel ... but it's damn close. To the point where if you're a Linux expert you are pretty close to being an OS X expert too. iPhones and ipads are Unix derived as well.

Android is based on Linux. They use patched versions of LTS kernels. I think they're on the 3.10 series now.

Linux and all these OSes are Unix based, and Unix was first licenced in 1975, I think. Your whole OS is a blast from the past. Again this doesn't bother me.

I think it's pretty funny that Apple announced OS X as their big push into the 21st century while adopting a system dating from 1975 or earler. But at the same time I think it's the smartest thing they're done on he software end.

I use Xfce but I've had all the Mint DE versions installed and the only one I didn't actually like using was Mate. But that's just my personal opinion ... there's nothing wrong with mate and I often recommend trying both mate and xfce if someone wants a lighter DE. I quite liked KDE too.

If LXDE was better maintained I'd probably use that instead. I like the idea that my computer looks like something from the 90s but works pretty much like a Mac.

[z31fanatic]

Recently I have played more with Mint MATE because Cinnamon 18.1 is a disaster. MATE is fine but I feel Cinnamon is easier to make it look and behave like I want it.

I've also played a bit with the latest Zorin, Peppermint, Elementary and Ubuntu MATE. Once you start using other distros/desktops, you realize they are all the same with just a different menu so I decided to stick Mint MATE until Cinnamon gets fixed (or if ever gets fixed).

[sammiev]

Your link is dead.

Whoops. The link isn't wrong, actually. What is missing is that you need to register on the Arch Forums. Sorry, I forgot to tell that. As I've seen, Arch Forums have a part (Try This subforum) that's visible only to registered members (who are logged in ). For me it's working.

"Linkless path":
Arch Forums > Try This > What was your distro(s) before Arch Linux? > end of topic.

I've managed to make a little off-topic talk there.

I see, thanks for the update.

[DeMus]

I understand what you're saying but that doesn't faze me a bit.

Do you? When I just read it again just now I thought I should have written it a bit different. What I meant with my statement is not that it originated in the past, but it looks like something form the past. I, and I know many people will complain about this, I find it boringly dull.
When unity and Gnome 3 arrived I skipped to KDE and never looked back. KDE 4 and now Plasma 5 are amazing DE's. They are shining, sparkling, like it should be. Not the dull grey windows you see in XFCE. The desktop effects in KDE are amazing which adds to the modern look and feel.
But, each his own, I'm sure people don't agree with me (as always) and that's fine. I just love KDE and for me there is no other DE than KDE.

[Lucap]

Your link is dead.

Whoops. The link isn't wrong, actually. What is missing is that you need to register on the Arch Forums. Sorry, I forgot to tell that.

Can't you paste up the relevant information on here so we don't all have to sign up?

[Hoser Rob]

I understand what you're saying but that doesn't faze me a bit.

Do you? When I just read it again just now I thought I should have written it a bit different. What I meant with my statement is not that it originated in the past, but it looks like something form the past. ...

Yes, I got that just fine.

KDE doesn't look that modern either.

I've had both Kubuntu and Mint KDE installed. I llike KDE but most opf the apps I use are GTK based and are often too buggy in KDE. I am hardly alone in this.

[DeMus]

I understand what you're saying but that doesn't faze me a bit.

Do you? When I just read it again just now I thought I should have written it a bit different. What I meant with my statement is not that it originated in the past, but it looks like something form the past. ...

Yes, I got that just fine.

KDE doesn't look that modern either.

I've had both Kubuntu and Mint KDE installed. I llike KDE but most opf the apps I use are GTK based and are often too buggy in KDE. I am hardly alone in this.

Why do you use GTK based programs in KDE? Which are they?
I use KDE stuf and it all looks amazing, so to say KDE does not look that modern either is not true: it does look modern when you use KDE instead of GTK programs.

[Lemongrass38]

Can't you paste up the relevant information on here so we don't all have to sign up?

Well, I can. I didn't wish to recruit new Arch users with this thing. So, here it goes.

Main topic: What was your distro(s) before Arch Linux?

Lemongrass
1. Ubuntu
2. Linux Mint
(3. installed TAILS, but deleted it from USB drive)
4. Debian
5. Manjaro for a day
6. Arch

I'm in a hesitation whether my main distro will be Arch or Debian (none of them is too "heavy" and perform well). Now it's Arch. The thing that puzzles me the most is the fact of Arch having only ~38 developers and they stick to open source a bit less than the Debian Project. I mean, if someone wanted to put some malware or such in Arch, it would be hard, but still easier than infecting Debian, and hiding the malware from ~1000 developers.

As for Arch, it's a really minimalist and simple distro, and I like this.

drcouzelis
Hi

Lemongrass
The thing that puzzles me the most is the fact of Arch having only ~38 developers and they stick to open source a bit less than the Debian Project. I mean, if someone wanted to put some malware or such in Arch, it would be hard, but still easier than infecting Debian, and hiding the malware from ~1000 developers.

There are many reasons why Arch Linux can function so well with fewer people:

Arch Linux has fewer official packages than Debian.

Debian has multiple releases (wheezy, jessie, stretch) that all have their own set of packages. Arch Linux only has just one release: "now".

Debian supports (many, many) multiple hardware architectures. Arch Linux supports only two, soon to be one (x86_64).

Debian makes an effort to fix or patch any issues in a specific package. Arch Linux packages are generally "vanilla", so most of the time a new release of a software project means compiling it, building the package, doing a quick test, then releasing the package.

I'm not sure what you mean by how Arch Linux developers "stick to open source a bit less than the Debian Project".

One of the best features of Arch Linux is the AUR, where any user (including myself and you) can submit build scripts that other Arch Linux users can use to easily install software, including software that is not allowed to be included in an official repository (one neat recent example I encountered was asesprite, which is open source software but not free software, quite rare!). BUT, it's the Arch Linux user's responsibility to ensure that anything you install from the AUR is safe and has been packaged correctly.

...I guess that's another way Arch Linux cuts down on the number of people needed to maintain the project. Put the responsibility on the user. Clever Arch Linux.

Trilby

Lemongrass
I mean, if someone wanted to put some malware or such in Arch, it would be hard, but still easier than infecting Debian, and hiding the malware from ~1000 developers.

I think this could even go the other way. In arch you don't have 38 people checking every package while in debian 1000 people check every package. Rather it is (closer to) in arch each dev being responsible for ~1/38 of the packages and in debian each dev being responsible for ~1/1000. The latter set up leaves far more openings for something to slip through the cracks.

A post about Debian could stop maintaining old packages, and they would need less developers then. I didn't quote it, because this is the point, and I wish not support the stance of Arch being better than Debian. I'm not a judge.

Lemongrass
Thank you all for your replies... Really. I didn not want to make this sounded offending, I just had to note it. Arch is my first rolling release distro, please remember that I'm still a newbie among rolling release distros. I understand this much better now. And I have to admit that I really like Arch, its rolling release nature and the ability it gives to tinker my OS.

Any moderator is welcome to cut this last few posts into a new thread. I don't wish to speak off-topic things here. I can't make this a new topic now, but that would be the "neat" way of discussing this. smile

Trilby: I didn't quite understand you. Why does the latter set up leave far more opening for something to slip through the cracks? Did you mean that one could perform a man in the middle attack? Or could someone spot a not so thorough Debian developer (who doesn't use GPG all the time or such) and slip something in its code? I guess there might be something in this. I'm sure the 38 Arch developers can keep each other in mind, and it's likely that they know other. I can hardly imagine all Debian developers knowing each other.

Trilby
I saw no offense. It is veering a little off topic, but some discussion of what leads people to arch fits here.

As for my claim of more openings, it wasn't nearly so specific as you are thinking. Just a more general point on how groups of people tend to work. While dividing a task among more people may increase throughput efficiency, it generally decreases overall quality: too many cooks.

While there may be differences in the management of development, such as those you mention, that could be relevant to stability, I was simply suggesting that having a larger number of developers in itself would not likely contribute to stability (and might even have the opposite effect).

Alad
Obligatory mention of the Debian openssl affaire... guess that one did slip through the cracks. For 2 years. In Debian only.
https://www.schneier.com/blog/archives/ ... ber_b.html

My thoughts on these:

1. Some of these posts show Arch to be better than Debian, which is simply not true. I don't wish to become a judge here.
2. I don't agree with the not posted post, that said Debian maintains packages for a long time, but they should drop them. I don't think they should! Debian is simply not Arch, and not trying to be Arch. It's a stable, secure and free distro. I wouldn't like to maintain any Debian server where the developers stop maintaining old packages. They have to do this, because the servers often need that. Servers need to be rock solid. (IMHO Debian is better for servers).
3. The last post about a Debian bug is not a deal-breaker, because it doesn't show anything about the Debian developers' system. It's just a bug. Arch surely has bugs too.
4. These posts don't contain my opinion. I just copy-pasted them, and I'm not responsible for their content.

[thom_A]

Which one might that be?

I used it when I paint and draw in Krita.
http://www.pureref.com/download.php

It's not the only one. There are others which I have to recall like a board game I use when relaxing, which can be had in Mint's software center in GUI. I'm at a stage where I can't be influenced with whatever good things are being said about Debian and Arch-based distros. I've installed them, run them, and I saw no significant increase in speed, and this thing about security doesn't even have any documented proof. It's an overrating of something that's not even there.

Hi thom_A
I am using manjaro right now and have krita running on it...

I tried Manjaro couple of days ago just to see how Krita stacks up. You know, when you have 10 yr old computers you don't stop wondering whether a different OS could still be able to squeeze out some more juices to speed things up. Right away upon opening, I see Krita's brush (it's not even a large brush) lagging, meaning, there's a delay between brush and mouse or pen movement. Which is not exactly absent in Mint, but it's even more noticeable in Manjaro. It's just not worth continuing with these kinds of things. Oh well, back to Mint...

[Fred Barclay]

Manjaro and Arch, on the other hand (if I understand it correctly) trust the upstream developers much more.

Fred, could you please tell me more about this?

Do you have a source (some inner regulation or writing) that proves this? Also, do you know about such a thing for Debian?

It's certainly much easier to hide something from 37*2=74 eyes than from 1022*2=2044 eyes.

Sorry for the late reply - it's hard to find sources when all I have is an impression pieced together from 2+ years of reading about (and occasionally using) Arch.
Do remember that I'm comparing Linux to Linux here... we're still talking about a pretty strong and secure OS whether you use Debian or Arch (or Ubuntu, Mint, Fedora...)

Here's what I know:
Arch does have 38 developers and 50 Trusted Users (TUs). https://wiki.archlinux.org/index.php/Tr ... sted_Users The TUs oversee the "Community" repository in Arch, while the developers maintain the "core" and "extra" repos as well as (I presume) "multilib".
The Trusted Users are a separate group from the Arch Linux developers, and there is not a lot of communication between them. https://wiki.archlinux.org/index.php/Of ... background

[Arch] ships software as released by the original developers (upstream) with minimal distribution-specific (downstream) changes: patches not accepted by upstream are avoided, and Arch's downstream patches consist almost entirely of backported bug fixes that are obsoleted by the project's next release.

https://wiki.archlinux.org/index.php/Arch_Linux
I don't know the nature of these bug fixes. Are they security and cosmetic? Security only? Cosmetic/functionality fixes only? What would they do if they found a security vulnerability but a patch was not accepted upstream? I can't find any clear answers.

Debian proactively fixes security issues. For instance, they've fixed security bugs in Chromium and released 'em before the Chromium devs did! Now whether this is good or bad depends on your perspective. If you like the Arch philosophy of minimal interference with upstream, then you might see this as Debian tampering with code unnecessarily (after all, the Chromium devs did fix the issue themselves) and possibly creating new bugs by doing so. If you prize security above all else, then you'll probably appreciate this as Debian devs doing their job and even beating the Chromium guys in the process.

The AUR obviously can contain malfunctioning or insecure software, but it's not an essential part of Arch (still very useful, though!) Most of the popular packages in the AUR, or at least the ones I've used, seem to be reviewed and commented on frequently by members of the community. That's very good!

Arch doesn't compile their kernels with user namespace support (so, if you use firejail, "--noroot" won't work). I've read both good and bad about user namespace: some people feel it adds a bigger attack surface to the kernel and is not properly implemented, while others see it as a valuable feature. I'm personally of the opinion that it's a good feature that's matured enough for me to trust it, but that's my opinion as an end-user, not a developer.
https://bugs.archlinux.org/task/36969
https://www.spinics.net/lists/arch-gene ... 43068.html

This is conjecture:
Just because Debian has over 1000 project members doesn't mean that all of them are currently active. But still, I think it's safe to suppose that there are at least a few hundred active. This puts Arch/Manjaro closer to the ballpark of Debian (38 devs + 50 TUs is in the same order of magnitude as 200 or so Debian devs).

Always updating to the latest version means that you can get hit with every single bug that exists discretely for that package. Now obviously, this depends on a few factors:
(a). The bug is found and exploited for that version while you are still using it. If you use foobar-0.9.0, update to foobar-0.9.1, and then a vulnerability is discovered only in 0.9.0, it's no problem. But if the bug exists in 0.9.0 and later versions, then updating doesn't patch it (until upstream is aware and hopefully fixes it).
(b). The bug is discrete - i.e. it depends on and targets only that package. If an exploit for foobar requires you to also have flooblebar installed, and you don't, then it's not a concern even if it affects the version you're using. IMHO, with Arch's KISS philosophy, you're actually less likely to have flooblebar installed than if you were using Debian (though this is highly specific, of course).
And then, of course, it's worth remembering that even Debian Stable gets plenty of security bugs. I've recently subscribed to their mailing list and so far I've been getting about 4-5 emails per week about security updates (many of 'em aren't for packages I have installed, though).
https://www.debian.org/security/#DSAS
https://lists.debian.org/debian-security-announce/
These packages are still vulnerable on Arch according to the tracker: https://security.archlinux.org/issues/vulnerable
(Keep in mind that "vulnerable" does not mean "easy to exploit". A lot of security bugs require physical access to the computer, and as we all know, physical access == game over.)



Personally, after reading and writing all this I'm feeling a bit better about my concerns (though I would like user namespaces enabled). I might hop over to Manjaro again for yet another trial run...

Hope this helps!
Fred

[samriggs]

Hi thom_A

I tried Manjaro couple of days ago just to see how Krita stacks up. You know, when you have 10 yr old computers you don't stop wondering whether a different OS could still be able to squeeze out some more juices to speed things up. Right away upon opening, I see Krita's brush (it's not even a large brush) lagging, meaning, there's a delay between brush and mouse or pen movement. Which is not exactly absent in Mint, but it's even more noticeable in Manjaro. It's just not worth continuing with these kinds of things. Oh well, back to Mint...

ahh sorry didn't catch you were using 10 year old computers, sorry about that, maybe mint and the old krita might be a better fit for you, it might work better on older computers, the main thing you'll be missing is the guides but if you can handle not having them it should be alright and it also depends on the gpu, older computers might have more of an issue with that then the newer ones, depending on the graphic card for the opengl, which you can turn off but it will slow things down even further, I had an issue with this on an older laptop I used and could not even use the opengl for krita but the older versions worked better for this issue for me.

Fred that's a whole lot of info
Good info though
I'm happy with manjaro so far, I think it's gona be a good fit my use for a rolling release. I still love mint though.

[thom_A]

ahh sorry didn't catch you were using 10 year old computers, sorry about that, maybe mint and the old krita might be a better fit for you, it might work better on older computers, the main thing you'll be missing is the guides but if you can handle not having them it should be alright and it also depends on the gpu, older computers might have more of an issue with that then the newer ones, depending on the graphic card for the opengl, which you can turn off but it will slow things down even further, I had an issue with this on an older laptop I used and could not even use the opengl for krita but the older versions worked better for this issue for me.

I actually never used very old versions of Krita like the ones in Mint's repository. I'd rather use the latest versions, even when they're in beta. It makes no sense for me getting used to an old software which I know is undergoing heavy development. Habits are hard to break and I'd rather get used to new features as well as changes that have been made.

10 year old computers are not necessarily unusable for serious apps like Krita, Blender, Gimp and others. So Krita's latest versions are running just fine in my dual core PC's as long as the image size doesn't exceed 4M x 4M. Good enough for printing and practice purposes. My point was any non-Mint distro is not for me, probably even if I have a newer machine. The logic is simple. If Krita's latest version performs well and even better in Mint than in Manjaro, as I have found out, then I see no reason why it won't run better in a newer machine as well with Mint. I'm also using an app that doesn't support anything other than Ubuntu-based distros, aside from Windows and Mac.

To each his/her own, I guess. So I'm through with this distro-hopping thing. Linux Mint is just fine for my needs.

[Lemongrass38]

Hope this helps!

Sure it does. Thank you really much, Fred for your very detailed answer. I wished to say thanks a little earlier, but my life is also busy.

Your post helped me better understand the security aspects of Arch and Debian. I especially liked the Chromium story. The Debian developers are really serious about their security job. I'm subscribed to the Debian Security mailing list and not a day passes by without getting a few security letters on that list. Have fun with Manjaro!

I decided not to choose my main OS, just use what I like. Then I don't have to distro hop around and find a better solution because I'm not willing to choose one.