Linux Mint downloads (briefly) compromised

> I don't understand. Why would you ever want to do that? Surely it must be a lot less work to just build your desktop and artwork and whatnot against stretch and sid, and publish those?

I'm not sure what you are asking. Are you asking why a derivative should rebuild all the packages they import from their upstream distributions? If that's the question, then the answer is simple: To avoid the exact upgradebility issues that Linux Mint has. I'm not aware of any other distribution which has to blacklist single packages during updates like Mint.

> You can still build your own installer if you wish, and have a very wide leeway with branding. Not to mention the immense help building on established infrastructure would give. What is the background for this decision? On the surface of it, it seems like a lose-lose proposition.

Again, I'm not sure I'm grasping your stance. Are you in favor of mixed repositories or against it?

My point is: If you don't have the resources to rebuild all packages from source that you ship to your users, you shouldn't maintain your own distribution in the first place.

Sure, making your own spin of your distribution of choice is easy enough and fun. But the hard part is not creating those images, the hard part is providing proper support for that spin you created. The work on a distribution doesn't stop once the images have been created.

Adrian