Hacker News Reader

Manjaro is the one linux distro that recommended users set their clocks back in the past because they f....d up big time with their HSTS+HTTPS cert. [0]

Ok, that was 4 years ago, but still, I wouldn't dare use it.

And for those who will use Manjaro, please don't ask for support on the Arch forums/subreddit/IRC chan.

[0] https://www.reddit.com/r/linux/comments/31yayt/manjaro_forgo... https://webcache.googleusercontent.com/search?q=cache:NTDcUS...

View on HN

>the Arch Linux fork Manjaro ships a static private key on their installer image which also gets copied to the target system. The result is that all Manjaro users have the same "private" key and anybody can easily use this to sign any package that the package manager will accep

https://pierre-schmitz.com/random-but-important/

This post is 6 years old, does somebody know if this is still the case?

Reply on news.ycombinator.com