> Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using.

If we made all builds reproducible (like oasis) we could setup an automated trusted system that does builds verifiably automatically (like what Nix has).

There are already trusted sources of software packages that provide security updates: traditional Linux distributions.

Doing automated, local patching and rebuilding is far from enough. You need experts to correctly backport patches and test them thoroughly.

No, no… We need to move very fast, and break all the things. Tradition and conservatism is not the way. We need to compile everything and anything. Change the paradigm, break the status quo!

Oh, just like Gentoo, Slackware and LFS. ;)

Seriously, maybe we shouldn’t ignore history and learn why things are like this today.

People bashing distributions seem to ignore that the alternative is the google play store.

Which reproducible builds project is striving to do for quite some time.

It’s not just a simple switch you flick and recompile.

Yes but in general a system can safely be assumed to contain At least some software which was built elsewhere. Especially in more proprietary worlds like on Windows and MacOS.