I feel like this is ahistorical. for the majority of the time I've used OSS (!) distribution was explicitly NOT centralized: (Debian) mirrors were operated by anyone and everyone
But eventually (GitHub) we moved away from community infra to centralization, mainly for convenience
Conversation
Very much still hub and spoke though. And the labor of ftpmasters and other people in the release pipeline was also historically very centralized (if anything, much more than in the current dominant language-package-manager model).
2
1
hub and spoke is not centralized, it is by definition distributed with a single reference source of truth (i.e. the software as published), which does not contradict the above at all.
1
1
All I have to do is compromise one server to (eventually) compromise the contents of all the mirrors, and only one set of keyholders can do the core labor.
So, yes, the bandwidth costs are distributed but many other important properties of the system are very much centralized.
1
that is literally true of any single-source software which is... basically all of it? What software exists that is published in multiple places independently
1
kernel.org is the canonical source distribution location of the Linux kernel, of which official releases are produced by a single individual (usually Linus).
1
1
Linus makes the mainline releases but not the stable/longterm releases.
Nearly everyone is using downstream forks of the stable/longterm kernels. Even Arch never ships mainline kernels outside [testing] anymore and has downstream patches applied despite not usually doing that.
1
1
Most users are on a more substantially modified downstream fork of a longterm branch that's at least 1-2 years old. Most distributions take many weeks or months to ship the longterm updates if at all. There's near zero quality control for kernel.org releases...
2
1
The longterm branches have thousands of commits on top of mainline with frequent releases.
5.10.71 is from hours ago: lwn.net/Articles/87203.
5.10.71: 2021-10-06
5.10.70: 2021-09-30
5.10.69: 2021-09-26
5.10.68: 2021-09-22
5.10.67: 2021-09-18
Many have serious regressions.
1
1
It's not really a software project that can be built and shipped directly for production servers, clients, embedded, etc. It's unfortunate but that's the way it is for the time being. Need someone in between testing on the same hardware and fixing the regressions for serious use.
Right, that someone in between has been someone like me for the past 23 years or so.
1