Events of recent weeks have provided another reason one might be inclined to avoid the use of distributions. Let’s call this the “debian SSL bug”. A patch applied by a well-meaning Debian coder made cryptographic keys generated by numerous applications on that distribution entirely useless. Details can be found here.

The Debian patch affected derived distributions as well, such as Ubuntu. For almost two years, many cryptographic transactions were severely compromised. The biggest problem was that the patch was not correctly passed back to development team of the OpenSSL project. Had it been, they would have pointed out its fatal security implications, and this entire headache would have been avoided.

I always feel uncomfortable when I see distributions applying patches against the original sources. There can be several reasons for these patches.

1. They may be back-porting selected bugfixes to an earlier version of a library rather than including the latest version of the library with all of its new, and possibly untested features.
2. They may be modifying a logo or informational string to include something specific to the distribution.
3. They may be changing some default pathnames or other resources to mesh more well with the idiosyncracies of their own distribution.
4. They may be changing the appearance of the interface to make it more consistent with other applications.
5. They may be applying changes that the original maintainers of the package do not consider necessary, but which the distribution maintainers find desirable.
6. Other…

None of these motivations will usually convince me to apply foreign patches. Your opinion may differ.