They say debian is free and has its promise, but Arch has like 2-4 maintainers?
Debian Unstable, if you like to live dangerously and have to reboot every couple of years.
/s
I like that even without the “/s”
Two extremes here. Debian is slow to update while arch is bleeding edge.
I avoid containerized desktop apps (snap, flatpak) so I couldn’t run Debian as a daily driver. You’d want to use the latest FireFox and their repo’s release is old. You you can get it from flatpak, but I don’t want to do that. Running on recent (<1y) hardware will also be problematic. I guess you could keep on adding 3rd party repos to your install, though some post from debian forums always stuck with me: “Debian is only what is released + whats in the official repo. Install anything else and you’re not running debian anymore.”. Its a whacky OS and I love it, but daily drive it only on my server.
Arch puts everything on their repo straight away. And if its not there, you’re downloading code from AUR and building it yourself. I actually appreciate this since it complies with the philosophy that you can’t really trust your applications unless you read the source and build it yourself. Awesome, but the general public shouldn’t be doing this… I don’t mind applications being distributed in binary form. I am able to trust linux community maintained repositories. Arch is for the geeks imo.
I found Fedora to be a good middle ground, since it gets package updates straight away while still maintaining fixed OS releases. No need for snap or flatpaks since their repo has everything and is updated. Its also widely supported by software vendors (just like debian). Id go with it as a recommendation, but still note that its philosophy is free software only and this can potentially mean tinkering with additional stuff from RPM fusion, especially if you dance with nvidia and watch videos encoded with non free codecs.
It takes a bit of time to find the right distro and that is the biggest obstacle to linux imo.
Out of curiosity, why avoid Flatpak? I get snap or AppImage, but Flatpak is generally great.
why avoid Flatpak? I get snap or AppImage,
Objectively, they all frustrate validation the same. When comparing with a SLSA3-compliant setup where every installed artifact has a signed checksum in a signed bundle from a signed resource on a signed repository, and the endpoint to this is readily available from something like authenticated SNMP into the single source of truth, they all tends to compare poorly.
The chart below completely ignores that Debs are consolidated into a single source of truth as well, and I feel violating SSoT should cost significantly because of dependency holes when artifact registry is incomplete, but SLSA doesn’t care about that part.
Ecosystem / Format Estimated SLSA Level Update Reliability / Model Trust Chain & Provenance Comments (withheld) 3–4 Very high; repo-based, transactional updates Strong: signed packages + signed repo metadata + central DB; distros enforce reproducible builds. OCI containers (hardened pipeline: cosign + Tekton/in-toto) 3 High if using automated CI/CD and policy enforcement Strong if you use signed images + non-falsifiable provenance; this is rare but achievable. DEB (distro repos) 2 High; repo-based, APT handles dependencies Medium: repo metadata signed, but per-package signatures not mandatory; weaker checksum chain. Flatpak runtimes (Flathub) 2 High; centralized runtimes, predictable updates Medium: signed OSTree commits; build infra more centralized, but not full end-to-end provenance. Flatpak apps 1–2 High; repo-based, automatic updates Mixed: OSTree signing helps, but build provenance varies by publisher; no uniform SLSA guarantees. Snap (strict confinement) 1–2 High; centralized store, auto-updates Centralized signing by Canonical, but opaque build pipelines; trust is “trust the store operator.” OCI containers (typical public images) 0–1 Medium; pull-latest model, tag drift common Usually unsigned; mutable tags; no guaranteed provenance—trust is mostly social and reputation-based. Snap (classic confinement) 1 High; same store/auto-update model Same store trust, but classic snaps bypass sandbox; even more reliance on publisher integrity. AppImage 0–1 Low–medium; ad-hoc self-update or manual downloads Almost no chain of custody; signatures optional; no central repo or provenance expectations. npm (JavaScript) 0–1 High frequency, but low reliability of safety; semver + lockfiles Registry accounts can publish arbitrary tarballs; no default signed provenance; transitive deps explode risk. PyPI / pip (Python) 0–1 Similar to npm; pip + requirements/lockfiles Tarballs/wheels from arbitrary maintainers; no mandatory signing; provenance work (e.g., PEP 740) is emerging but not standard. Composer / Packagist (PHP) 0–1 Good tooling, but same “trust the registry” model Packages pulled from Packagist/VCS; no mandatory signatures; dependency graph trust is social, not cryptographic. CPAN (Perl) 0–1 Mature ecosystem, but manual/legacy in many flows Historically minimal provenance; mirrors and authors are trusted by convention, not by SLSA-style attestations. Other language registries (RubyGems, crates.io, etc.) 0–1 Similar to npm/PyPI; lockfiles help reproducibility Central registries, but no default SLSA provenance; integrity is mostly TLS + registry operator trust. Man, I really need to check out “(withheld)”
Seriously though, nice table!
the table reads like AI output
Not parent poster, but this is a detailed explanation for the big ideas.
Wow, thanks for the link! I’m a huge Flatpak fan and always thought they were awesome. I still do, but a lot of the issues in that blog were news to me. Thanks for sharing, it was a really good read!
I avoid containerized desktop apps (snap, flatpak) so I couldn’t run Debian as a daily driver.
Wat? this is the dumbest take of the day.
Feel free to chose either one, but avoiding Debian for this reason is just plain wrong.
Not OP, but this is a fantastic answer, and I wish I’d read it before installing Deb on my wife and friend’s computers!
I use CachyOS, but decided “bleeding edge” would be more of a nuisance than help for them, so opted for “very stable”, then immediately ran into challenges trying to get apps, and needed to get containerized apps for everything. I should have gone with something Fedora-based or just stuck with what I know, CachyOS.
what apps did you need to install containerized?
Stremio was the big one, but maybe I just didn’t try hard enough.
Getting Wine/Bottles working with a niche work remote desktop streaming app was a huge pain, too, while in CachyOS it’s 1-click to get it all set up from the Hello app.
On my CachyOS desktop, I use Docker images for a couple things: my mesh wifi network controller server (Omada) and for ripping Kindle books to .epub with a specific Windows setup that still works (I need to read with TTS and Kindle broke native Android TTS when they implemented their own shitty TTS option, so I .epub everything.)
I don’t think I use any other containerized apps, aside from my work Windows VM (which is only required for SharePoint integration in Explorer.)
It takes a bit of time to find the right distro and that is the biggest obstacle to linux imo.
It’s also the greatest benefit. Vanilla stuff works out of the box for most, but once you need more, there’s a paved runway headed in any direction you want to go (some in better shape than others to be fair).
Windows and OS X are certainly wider runways, but there are cliffs off the side of you want to change direction.
Good things usually take time, but you will know where you are when you get there.
Teach good debugging practices early
I use Arch btw. Arch is amazing, but you need to be willing to learn a few things. No shame in wanting an easier distro that just works.
If you have to ask, you definitely don’t want Arch
I use both, debian on servers and old machines, arch on my desktop. Arch being rough is way overblown in my experience, the install script makes it straightforward to setup and it’s been pretty much painless since I switched to it two years ago, I had experience with debian before that. Both arch and debian have fantastic documentation available.
Debian and derivatives, in my experience, are really well supported so that’s a plus. Age of packages has never really bothered me and cases where I want bleeding edge there’s options for that.
Both are solid options and I don’t think you’ll be upset either way, if you can I’d try both.
Debian user that reccomends it. I don’t game or need latest gizmos. I want and have a computer that is very reliable and maintenance free.
I’ve been a Debian guy for a long time for one reason, stability. I don’t game a lot, but haven’t had an issue in years, my son uses arch and games way more than I do, but he also has to fix a lot more stuff that updates seem to break.
If you are under 30 I almost want to encourage Arch as you’ll be forced to learn a bit more over time and learning is never a bad thing. If you might game some, but value a rock solid system, go Debian.
Debian is chosen for Satellites because it is “stable”, that is it doesn’t do major changes like changing the Kernel.
Arch isn’t for beginners, but it’s a rolling release distro that’s nice and simple but powerful.
You do have the option though. I run LMDE7, and installed a 7.0-prempt kernel yesterday because I felt that I was seeing too much stuttering in 3d games. I installed it from my package manager which already had debian Backports turned on.
If you want your system to be reliable, stable and in essence boring: Debian.
If you want to be hands-on, on the bleeding edge and updating daily: Arch.
Neither. Void or OpenBSD. Not hating on SystemD, but I aint lovin it…
If you want to go with bsd, just make sure your hardware is supported
Why is this a issue btw? I get that porting Linux drivers also requires manpower. But no wrapper or automatic patcher chain for them?
I like Arch. It’s a rolling release distro with a nice community. However there is no installer. You have to install it by hand. That’s why many people who never touched Arch themselves keep telling it’s “too hard to install”. Actually the process is well documented. You’ll need like an hour for it, but in return you get a system, that’s slim and perfectly tailored to your needs.
https://wiki.archlinux.org/title/Installation_guide
However, if you just want to do casual things like browsing the web, debian is absolutely fine. But be aware, that the packages are antique. Also I never survived a dist-upgrade once in my live. There was always broken configs afterwards.
What do you mean by free? Why did only those two make your list?
In general, I recommend Fedora KDE Spin (or Fedora Kinoite if you know what containers are)
For your question, I would go for debian. But the answer also depends on your use-case. Software dev? CLI user? Gamer?
Fedora KDE is not a spin anymore. Fedora embraced KDE fully now. Which is nice.
I feel somewhat bad for using Fedora (IBM Redhat and all), but it has been unmatched on keeping up with current applications while being absolutely painless to use.
I have updated this laptop through three major versions and I have not had a thing to do yet. It is as up to date as my Cachyos laptop with zero effort.
For those warning you away from Arch, it doesn’t have to be like that anymore.
I installed Garuda as a Linux noob and it has been petty straightforward and problem free. You don’t have to build Arch by yourself in a cave from scraps anymore. Garuda supports Nvidia too.
Just make sure you have pamac installed, it’s the one thing my build didn’t do and it made software installation and updates way easier.
I feel like there are other options here. Fedora? OpenSUSE?
Fedora is so, so nice. I have it on all my personal computers.
At my work they only tolerate Ubuntu. My God, it can be so frustrating. Snap gets in the way constantly. Somehow Ubuntu LTS seems to have a knack for precisely choosing the worst package versions for a workstation.
Fedora on the other hand just gets out of my way and lets me get shit done.
I am obligated to recommend Alamalinux at any and all opportunity
