Billy O'Neal (malwareminigun@infosec.exchange)'s status on Thursday, 02-Nov-2023 04:54:26 JST

@lanodan If I make a snap package or similar I don't have to manage that, because my app comes with all its dependencies.

Similarly if my app is a bash script or I can statically link everything that matters.

Again, putting that into an rpm or deb does not fix the original argument, since that rpm or deb won't be signed by the distro. Installing malicious code through an rpm or deb is no different than installing malicious code through curl|sh.

If you require it to be signed by the distro, you are back in 'supporting Linux actually means supporting ~10 different platforms since there are ~5 distros that matter and their different versions are different universes'. This is a big part of why there's almost no commercial software on Linux.