Good for them! A second TLS problem after what happened last time is unacceptable. I hope the 'mutiny' succeeds.
post
Honestly the damage is done. Manjaro has been an instant no from me dog for a long time. The name carries a negative connotation. Trust has eroded.
What happened?
Plenty of things, but the most obvious being the two separate instances they had issues with renewing their certs.
It's more than that. Broken updates. Failed hardware ventures. The project has been shambling along for a long time.
and the certs lapsed again after volunteers built tooling to Prevent That
but somebody never set up the cron job to run it
Don't forget their package manageer DDoSing the AUR multiple times
I liked Manjaro, they had a nice theme, it was in the direction of Arch, but still had some guardrails for the noobish.
Then my system kept breaking, then they screwed up their certs. If they want to fork it and go forward with a different focus/ideology, that's fine by me.
Could you please explain why not renewing their certs is such a serious betrayal? Like, if they fixed it, isn't that okay? And even if it happened again, and they fixed it again, isn't it human to err? Or why is it such a harsh offense?
Serious question, I don't know the consequences of not renewing these certs. 😊
It's the tls certificate that proves your website is legit. Without which, you can potentially be a malicious actor that can pose as the website, and when you download the iso, you could unknowingly download something malicious. It's pretty hard to forget certificate renewal (most of the time there are plenty of reminders sent and warnings given), so the fact that it happened twice was very impressively bad.
It's pretty hard to forget certificate renewal (most of the time there are plenty of reminders sent and warnings given)
Oh boy. Seems to be the opposite in real life. Especially when it comes to managing stored cert of businesses partners. It has gotten somewhat better now of course, but three years ago most of my company's sev1 production issues were due to lapsing or unscheduled cert changes.
it's the main way for software to verify the identity of a source. without it you let nefarious actors do something like hijack a DNS server and impersonate your servers to your users, which is a pretty big problem if you're running a software distribution network! it is literally a breach of trust and massive security vulnerability. and it probably broke a ton of shit when software that uses the certificate found an expired one and suddenly (and correctly) refused to work.
People are very harsh with Manjaro. There's more than just a list of objective facts unfortunately. I suppose there were some bruised egos at some point.
The certs issue wasn't a big deal, it didn't change anything for me as a user. It just paints a bad image.
As a former Manjaro user, it has some issues. It has weird bugs that aren't present in any other Arch-based distro. Pamac ddosing the AUR is pretty bad as well. I'm thankful I used it as long as I did though. It got me hooked on Arch based distros. Everything else feels antiquated now. Actually, Void Linux is kinda cool
Its not just the fact that certs expired, it's them advising people to bypass warnings or change their system time and how many times they've had the issue.
I don't recall anything related to accepting warnings or changing system time but I may have missed it.
Failing to renew TLS certificates on time multiple times is enough to never touch it again, but there's also been a lot of other problems with Manjaro.
When I used Manjaro, it never made it more than 6 weeks before something would catastrophically break and I'd have to roll back using snapshots.
The manifesto mentions this and that tooling had been made by volunteers but leadership ignored or rejected it (wasn't clear which). So it seems that they are firing their leadership for the same reasons you want to stay away, which is a good sign, at least. Like promising that they are willing to mutiny to stop the enshitification.
Yeah the last time I tried manjaro years ago it kept breaking but I thought that was just the linux experience at the time haha
The trust. It eroded.
I mean, I think they were looking for a little more detail that that.
Keep the dumbass reddit style "jokes" to reddit. Either answer the question or stfu. You're not funny and your lame attempt at a "joke" is just annoying.
There shall be no mirth in this place!
And yet their "unfunny lame attempt at a joke" got 90+ upvotes, so clearly some people thought it was funny.
I don't see anything in the rules that says you can't make a joke in the comments. The only thing that comes close is rule 7, and even that allows comments. Maybe you should go back to reddit?
If you're bringing the rules into this conversation, you're misunderstanding the conversation
from what i undertand, everyone else is making jokes and enjoying them while one person has to be a debbie downer
Hah, sure, I'll cop to that, you're the downer for bringing up the rules lol
bro, i was saying that the rules allow jokes. jfc. downer was the person saying to take the jokes back to reddit.
Aragorn writes that Philip Müller (the project lead) has been running Manjaro as his own personal venture rather than a community effort, keeping a tight hold on access to both the codebase and the infrastructure.
These weasels never care about the actual thing that is being built, its just a way to make money for them.
Hope they kick that Philip guy out and get back to making this a passion project.
The core members with passion for the actual thing should restart under a new name.
Just fork already. EndeavourOS exists, an awesome distro, so this threat is a triviality.
Is Garuda a serious distro? Last I heard it was basically a few people's hobby project. Not to say one shouldn't use it, but I don't know if it's on par with EOS and Cachy.
No. Let Manjaro die. It has no reason to exist in any form. Go contribute to something useful.
Except that I want the same release cycle as Manjaro. The only equivalent I have found so far seems to be OpenSuse Slowroll, in beta for the past 2 years.
Picking Manjaro for stability 🤣 that's a new one.
I've never regretted it for the past 7 years on my daily drivers. That's why I don't get the constant criticism around this distribution.
Philip can't operate letsencrypt. And he's kinda just a shitty neckbeard. Try debian.
I love Debian. Debian is king, Debian is life! However on my desktop I prefer a semi-rolling release distribution.
If you have 8+ cores there's always Gentoo 😇
If I may, would you seriously consider switching to openSUSE Slowroll if Manjaro's situation doesn't improve? Or, are there reasons beyond its beta status that hold you back?
I used to hop distributions in my youth, between 2000 and 2019. I have settled on Manjaro and never looked back.
As of today, my desktop works perfectly and I have not seen any stability issues.
I am considering testing openSUSE Slowroll in the coming months but not on my main computer. What's holding me back is that I can't see any momentum behind Slowroll. I have no clue if the solution will be supported for a long period. I'd like to have more guarantees than what is on openSUSE website.
Great answer. Thank you!
I hope openSUSE will eventually get around and enjoy some much deserved momentum. I feel it isn't quite reaching its full potential as a project, because it (somehow) fails to attract a bigger audience. Don't get me wrong, it's definitely doing well and it holds its own admirably. But, (going off of ProtonDB's data) where Fedora (together with its derivatives) managed to effectively increase its market share by at least 400%, openSUSE^[It's the green colored bar found right under Manjaro] -despite Tumbleweed making more sense for gaming- was only able to keep what it had...
I don't think openSUSE markets itself properly. I can't believe EU_OS picked Fedora instead. That makes 0 sense.
I (mostly) agree. I believe that bootc might have played a role in EU_OS' decision to pick Fedora over openSUSE. Back then, it wasn't possible to use it outside of Fedora's ecosystem. But Bootcrew has since released bootc images for other distros; including openSUSE. So hopefully they will reconsider it.
They need to cast out the person who can't renew the ssl certificate.
Who renews certificates these days? You automate that now, especially with 47 day certs coming.
As others suggest, why stay attached to Manjaro at all? Instead of forking, what about expending that energy on a rising distro without such reputational damage?
CachyOS is very close “in spirit” if they want to develop modified/custom packages, but there are plenty Arch downstream distros with less toxic communities.
They could even fork some other project and make the changes they like. It’d be a saner base than Manjaro at this point.
EndeavorOS too, which is even closer to "vanilla" Arch than CachyOS.
You are assuming that the cachy devs want the help of folks who have not demonstrated competence in their own project or want to do stuff how manjaro does
I started using Manjaro long before all this crap started going down, and I've been holding on hoping this all gets sorted because I hate distto hopping.
But sadly I don't think its going to happen. I've got a new PSU coming to fix a burnt out one that has left my desktop turned off and unupdated for two months. Might be time for an install of something new rather than updating afterwards.
It's indeed the time. I found Cachy was a good pivot, similar feel but seems to work better overall. Manjaro is still based on Arch after all, technically.
I also started with Manjaro, but it's broken mess. I moved to Garuda and it has been completely solid and stable for over a year.
The fact that CachyOS more or less successfully replaced Manjaro's purpose I guess is evidence of Manjaro's issues.
I forgot but I think Bazzite had similar complaints (due to its use of silverblue) in which case it was just more straightforward to use Fedora or OpenSUSE if you don't want to work with the read only root system.
Downstream distros need to bring additional value to the table to be worth using, otherwise there's really no need if you can make a package group that accomplishes the same thing in one go.
I had been using Pop-os for about a year but wasn't completely happy with it. A friend suggested Bazzite and, to me, it was a lot better in some ways and worse in others. I've since switched to Fedora and don't really have any complaints. I don't plan on switching again baring something I don't see coming.
gaurda is what manjaro should have been. its perfect for noobs with snapper in grub ootb.
i also like envdeavor anc cachy too
Just quit and move to CatchyOS
I don't game on my laptop, so the benefits of CachyOS over my EndeavourOS are moot.
I had to check boxes for gaming packages specifically to get installed. It's an extremely fast Arch fork first and foremost, with gaming features second.
I thought it'd be gaming first too but it was clear during install that's more of an "oh also".
Huh, that's too bad. I used it for years to get comfortable with an rolling release arch distro. I thought it was good, but it would break from time to time. Thankfully, Arch is easy to install and maintain these days.
awh comon I just installed it for the first time, what's wrong with Manjaro?
I wouldn't necessarily say it's bad, but I don't use it because:
- The project's had a history of failing at really basic administrative tasks like keeping their ssl certificate up to date
- I'm unconvinced they actually do the testing that justifies the delays and not just using arch. This is because security patches sometimes also get delayed and issues have gotten past the delay
- They've accidentally DDoSed the aur multiple times by shipping broken versions of pamac when fixed versions were available
- I've seen complaints about leadership and how they handle finances, though I haven't really looked into this
It’s not so much that the distro is bad, but the leadership of the project, according to a lot of the community working on it, is very unresponsive, bad at administration, doesn’t make decisions that need to be made in a timely manner and not really doing their job. The community basically wants to cut them out and move on.
Don't worry, it's just the open-source version of the market correcting. There's no stock, no venture capital. If the group putting in time and effort to help maintain something doesn't like how the project is being run, they take a copy and start over with a new name. It's happened countless times on OS, it'll happen countless more. Often, the existing leadership is burned out, some of the more active members move on, and those left through attrition lack the skills to keep it going. The forks generally move forward faster and cleaner with more active people. Other than needing to change distros, it's pretty much a win.
I dont know about manjaro, but manjaro for arm is dead in the water and hasnt updated its packages from upstream (arch linux arm) in ages.
I assume regular manjaro has similar issues? Dont know though, and im guessing
top 94 comments