Recently, Linux Mint experienced a security breach. What can we learn from it?
1. Security is always an issue. It doesn't matter what you do, you always have to be alert.
2. Convenience tends to get in the way of security: the more convenient something is, the less secure it tends to become.
3. Transparency and honesty are the best way to handle security issues. Ignoring them or denying them only increases their negative impact (and reduces one's credibility.)
4. Security cannot be fully automated. A responsible person must always be in charge. Those who think that automatic face or fingerprint recognition are the best security tools must think who is in charge of programming and calibrating such devices... and how secure the process leading to that automated recognition actually is. Also, these days it is way easier to steal someone's face with the help of Facebook, latex masks and 3-d printers than stealing a good password.
5. The person in charge of security must act promptly once security is compromised. Any delay is unforgivable.
Now, specifically, what measures could other distros take to make their sites safer? Here are some:
a- Signing the final iso files.
b- Signing checksums.
c- Keeping such signatures in a very secure server.
d- Using HTTPS (SSL).
Those are some thoughts. Any others will also be welcome.