dotfiles VS security

This is how I do it, and I get maximum control over the installation.

I have a very similar setup, but I use my custom wrapper over startx. Nothing fancy though: https://github.com/myTerminal/dotfiles/blob/master/.scripts/linux/mt-desktop-mode

I've used Arch for a while before switching to Debian and then Void. I still install my system using chroot (I did debootstrap for Debian too), so I did read the Wikis (and still do) and keep looking to install other distros the "Arch way".

I've been using this and this and I don't really care anymore.

Getting to know Linux better from my initial days with beginner-friendly distributions to stepping into the manual installation of Arch (pacstrap), Debian (debootstrap), and Void (xbps) has taught me a lot more of Bash than I would have expected from myself. I now also maintain my personalized setup scripts along with my dotfiles. Furthermore, I also created twiner as a re-usable tool (that tries to be a lot of things at the same time), which "sort of" helped me deepen my understanding of Bash a little bit more.

I start from here and then it takes me to this, eventually to i3wm.

I've been maintaining my own dotfiles on GitHub for over seven years now (and probably have also overdone it at some point of time) and though I've had some small challenges to use them across machines, I've never experienced something as big that I'll need a third-party "dotfiles management" tool to take care of that for me. I sync it through my GitHub account and pull updates regularly. Fun fact: I've also been able to use the same one across macOS, Linux, and even Windows at work!

All that we need for this step resides under here and fortunately, with all the scripts arranged as an independent Bash program, we'll only be running a single command and the scripts will take care of the rest for us.

At one point, I eventually started maintaining a single bash file in my GitHub dotfiles with the command and so there was no need to maintain spreadsheets anymore. This arrangement also allowed me to document the commands required to configure additional package sources and remained as a single file for quite a long time until one day it all of a sudden exploded into multiple smaller files each for its own purpose.

My setup is pretty-much automated as you can see here. I also have been keeping a separate partition for my home for years now, most of the data within being synced via Syncthing on several devices, and then I use pCloud for super-huge files. With BTRFS, the home now remains in the same partition as a dedicated sub-volume and I'm liking it till now.

So, yes, there have been vulnerabilities obtaining remote code execution. Like this one: https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md which has a little animated gif of a proof-of-concept attack.