The reason it is called
blind trust, is because it is different from the concept of trust. To which trusting something, for reasons other than having absolute knowledge, to absolute ability, is a thing.
Reasons being accountability, in one form or another.
Thus, things that can only be blindly trusted, are not equivalent to things you can put trust in.
This is true for repos, distros, software.
There is a bit about the relation of trust between them in the middle of this post too.
Here is a rule of thumb, if you put trust in something, you have, to the ability of your own rationality, a verifiable metric in which you can account for that trust.
If one part is a weak link, to your ability to find and survey it, the whole thing becomes irrational.
If you put faith in something, you are on that slippery slope of becoming a Windows 10 user.
If you put trust in something, in the sense that you heard it was safe. You may or not be safe, depending on whether that was true or not.
If English was a stricter language, we could make distinctions between putting faith, having faith, putting trust, and having trust in something.
With the aware and protected accounted for,
whether arrogantly religious, or ignorantly unaware, the notion of your safety depends. It depends on what happens.
Being a danger to yourself or avoiding seeing danger, however it comes about, can be safe.
My dog in this race is to avoid people being a danger to others. Together we can help matters. Come by the
friendly Linux|Gnu thread.
That still requires you to trust the source code in the end.
Sure, in principle, you can check all of that yourself, but it is unrealistic that any single person knows what every single line of code does, his system was made of. At one point or another you need to blindly trust the work of others.
Yes, with software you have to trust the source code, and the compiler. What your argument hinges on, is that free software isn't safe, because it isn't bulletproof. You are arguing against the most safe approach, on account of what exactly? The merits of not being able to? If you don't wan't to trust the work of others, don't. Nobody forces you to use free software.
In the sense that interaction is the danger, yes, but go where you want, and make amends.
... that is by no means bullet-proof.
Debian had it's fair share of "maintainer fuck-ups". Some were harmless, some were not. But they all showed, that after all, even approved Debian maintainers are just human. Humans make mistakes.
It's from contrib, because the Debian package itself conforms to the DFSG.
No, you don't (have to go out of your way). It's one checkbox in the installer. This is unchecked by default, but many users have a habit of checking it for no good reason. Because this is so easy is part of the reason why the FSF doesn't recommend Debian.
And nobody said it
was bullet-proof. What I said was it was a verifiable chain of events. Anyone can audit that, which is short of
nobody. The premise that humans can be helpful or malicious doesn't change the premise that software is built by people before you have a singularity, or automatically generated code. Yes humans can also be err in ways even unbeknownst to themselves, but it all works because humans are egalitarian. These are the principles we apply to software, but not how software actually works. In more of a game-theory way. While imperfect, it is the imperfections we have. Over time these can adapt and be adapted into workable premises, futile and perfect results. Notice here the relation between science, genetics, and best of breed software.
You need to
one, enable it, and
two, install it. People package software, yes. If you want to get source-code from your repo, do that, yourself, all the way. There is no avenue where you are prevented from any approach here. Also, for the rational expectation that software is bulletproof, you can share it freely. It is still an assumption, but one that is possibly vetted.
There are plenty other distros than Debian. If you are worried about accidentally enabling repos, and installing software from them, get a FSF distro. Where they take the approach of no nonsense, nor any third-party reccomendations of nonsense.
https://www.gnu.org/distros/free-system-distribution-guidelines.en.html
This is a different topic. If you don't trust the manufacturer of your core OS, then there is no chain of trust to begin with that can be broken. It makes no sense to argue on that ground. You should change your OS right away when you've reached that point. In principle you have the same problem with every OS. Talking about chains of trust only makes sense, if you trust your core OS in the first place.
Which is why your original argument was incoherent. A chain of trust makes sense for every single chain you make, regardless of the state of your core OS. Putting trust where it doesn't belong is worthless. If your core OS is untrustworthy, you are still hinging on that benefit of the doubt for everything else you do. If it is compromised and you know about it, you do something about it, you don't make this theoretical position of known-bad out to be a normal for considering between good and unknown-good.
My body is inherently unsafe, yet I don't walk into traffic on the notion that I
could have cancer anyway.
No, you wrote it. Nice try though.
"Most of Linux' reputation for being a safe system is either outdated (Windows has caught up a lot), or due to the behavior of its users rather than the technology."
To which I said:
"And no, the security of Linux|Gnu is not dependent on what windows does, let that idea stay in the confused mind that wrote it.
Just because a user is a user, doesn't mean a user is in an equally good position with a garbage OS. You can not argue something on a technical basis on the merit of its users. That is a non-sequitur comparison."
Notice the period. When you make one flawed assumption, and incoherently try to string it together with something else, it is warranted to deal with the two misconceptions as is, because that is what it might create. Also, you wrote "or", so in any event, unless you were guessing, that part is wrong. Premise A is wrong to statement B. A is wrong, B is wrong. There is a unrelated claim in the middle of it. Which is true but false on account of thinking it a polar scale, and doesn't accord for the general trend. It is dubious. And for how it is presented, erroneous.
This whole thing manages to be egregiously wrong.
Even IF statement B made sense, it would
still be a non-squiteur argument, because you are suggesting that the reputation of Linux relies on user behaviour, which is a unjust metric for an OS, and also not why the reputation of Linux is what it is. The irony strikes you down.
The hinge of the branch you extended your argument onto, is the tangent that broke off and took you down with it, and then in a mental upheaval hit you on the head long after you yourself hit the ungrounded plains flat.
There are a few ways to go with the last part of what you wrote, which when explored point to the last part of what I wrote.
"The last argument is unsubstantiated, historically, at present, and by you. It lacks any falsifiable semblance of content. It is vague where it should be clear, and incorrect where it shouldn't."
I have nothing against an app center. I actually prefer it as you then know it should just work and it will be free of viruses and malware and whatnot. But when you see something you like and it doesn't exist in the app center (like Brutal Doom) there seems to be little else to do but to give up as I have no idea how to manually install or compile things on Linux. I really don't get why there hasn't been made a bigger effort to autoinstall independent files you find on the internet. The Amiga has an installer that ask you to accept certain parts during the installation or cancel so you know what it's getting installed. You can also chose your level (beginner, mediate and expert). Beginner installs everything for you automatically, mediate lets you chose stuff like where to install a file if you have options and expert forces you to look at everything. You can also pretend to install so you see what would happen if you did. I like that solution.
