Manjaro website off-line again due to lapsed certificate • Hacker News Board

Re: Manjaro website off-line again due to lapsed certificate

#41

Post by hulitu » Thu, Feb 26, 2026, 6:15 AM UTC

ratorx wrote: post #25

dijit wrote: post #17

Earlier quoted context omitted.

"I use arbitrarily complex software that has a rapid SDLC to obfuscate the issue with the fact that we have to have military grade encryption for displaying the equivalent of a poster over the internet". The state of our industry is such that there will be a lot of people arguing for this absurdity in the replies to me. (or I'll be flagged to death). Package integrity makes sense, and someone will make the complicate…

Changing the links and doing nothing else would be a pretty dumb MITM. You could do a more complex variant which is not so easy to spot (targeting specific networks, injecting malware whilst modifying the checksum) The key property of SSL that is useful for tamper resistance is that it’s hard to do silently. A random ASN doing a hijack will cause an observable BGP event and theoretically preventable via RPKI. If your…

> The key property of SSL that is useful for tamper resistance is that it’s hard to do silently.

Not when you control the certificate issuer.

Re: Manjaro website off-line again due to lapsed certificate

#42

Post by HendrikHensen » Thu, Feb 26, 2026, 8:56 PM UTC

Mond_ wrote: post #4

I used Manjaro for a few years. That's how I learned a pretty important lesson about software engineering that still informs how I work to this day. "A layer of abstraction on top of a stateful legacy system often doesn't result in a simpler system, it just introduces exciting new failure possibilities. This especially applies when the owners of the legacy system have no responsibility over the abstraction layer."

Can you explain it for those out of the loop?

Re: Manjaro website off-line again due to lapsed certificate

#43

Post by Mond_ » Sun, Mar 01, 2026, 5:05 AM UTC

HendrikHensen wrote: post #42

Mond_ wrote: post #4

I used Manjaro for a few years. That's how I learned a pretty important lesson about software engineering that still informs how I work to this day. "A layer of abstraction on top of a stateful legacy system often doesn't result in a simpler system, it just introduces exciting new failure possibilities. This especially applies when the owners of the legacy system have no responsibility over the abstraction layer."

Can you explain it for those out of the loop?

Manjaro sells itself as "Arch, but more approachable". In reality, you'll often end up with "Arch, but with additional weird package management upgrade issues that are a byproduct of Manjaro's own repositories interacting with the arch on your system."

Instead of just having to track the arch repos, you suddenly have those and Manjaro's own stuff (and own package manager tool etc.), which is another point of failure. Every new bit of technology is another part that can fail.