Arch does tend to keep packages as close to upstream as possible, which can be both a good and bad thing. Sway not binding to graphical-session.target by default is a little strange for example. Other distros also save a first-time user a great deal of configuration for things they probably don’t care about as well. Going through Fedora’s install and finding out that disk encryption and SELinux were configured OOTB was very nice to see personally. On the other hand Arch’s installation (w/o archinstall) has you choosing a bootloader, audio server, display manager, etc. Nothing arduous and I like it, but definitely not for everyone

This is all eliminated by spinoffs of course, but even there users have the option to run random scripts/AUR packages without vetting them. Also doesn’t help that the most popular Arch-based distro for a while (Manjaro) was pretty flaky and generally incompatible with the AUR (despite saying otherwise), leading to many people saying “that’s just Arch” and swearing off the parent project as well

The back end is open source, but sometimes they’ve lagged years behind releasing the source code.

I think this is the more worrying part if true. The backend is licensed under the AGPL, so this would technically be a violation of their terms

13. Remote Network Interaction; Use with the GNU General Public License.

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software

Edit: For anyone else reading I looked into it a bit more and looks like the issue came to a head around 3 years ago, with this comment being made after a year of missing source code. The public repo has been pretty active since then, so the issue seems to be resolved

If I had to guess I’d say that their other project, Sponserblock, got a little bit more popular than they were expecting and this is just to help alleviate server costs. Most of the API endpoints don’t require any auth at all (the single one that does accepts a random UUID), so any checks must be locally done (maybe system time?). The extension and server back-end are licensed under GPLv3 and AGPL respectively and are also entirely self-hostable, so the code is out there to verify if you wish

Additionally if you’re looking for it to start on boot without logging in, you might find the loginctl enable-linger command to be of use. Maybe along with a Restart=on-failure policy in the service file if this is for a headless unit or something

They’re talking about the Hogwarts game