News for hackers. Stuff that matters.
Re:The modern packager’s security nightmare by oblio on Sunday February 21, 2021 @04:59PM (#26217672)
The open source solutions are primarily for C/C++. A bit for Perl, a bit for Python. But they haven't really moved on. Java has been tacked on since forever. Same for .NET, JavaScript, whatever.

And if you wanted your program propagated to all major distros you'd have to wait a decade.

Nobody has time for that. Not corporations, not mom and pop stores, and I doubt many hobbyists.

Re:The modern packager’s security nightmare by ticviking on Sunday February 21, 2021 @05:20PM (#26217855)
Then you always have the option to package your software for the ones you use and not worry about the rest.

If you want to make your program popular then packaging is part of the process needed.

Re:The modern packager’s security nightmare by lifthrasiir on Sunday February 21, 2021 @06:37PM (#26218498)
That's not the problem. (*) The actual problem is that the distro maintainers want split packages (for security and so on), not vendored, and this requirement was already burdensome for many languages other than C/C++. If vendored packages were acceptable I believe people would have of course contributed them. Maintainers made this obstacle themselves (for a good cause, arguably) and it seems farfetched for them to then complain other languages are uncooperative.

* Was "isn't that a problem?", which was not I meant to say.

Re:The modern packager’s security nightmare by jholman on Sunday February 21, 2021 @07:59PM (#26219236)
> If you want to make your program popular then packaging is part of the process needed.

That is demonstrably not true. I'm not making a value judgment (maybe it SHOULD be true, I dunno), but it's not true. There's a lot of popular unpackaged software out there.

Re:The modern packager’s security nightmare by virgo_eye on Monday February 22, 2021 @06:07AM (#26223146)
I mean the whole argument here is that distro packaging is not needed, that there's a better way of doing it.
Re:The modern packager’s security nightmare by ticviking on Monday February 22, 2021 @07:27AM (#26223710)
That actually clarifies some thing about the debate for me. Thanks.

I'm not sure I'm convinced based on the semi-frequent posts from maintainers and security pros about the issues with vendoring dependencies for software that is widely deployed.

This "better way", since we lack a more concrete name. Seems to be really great if you're running a web app, or server software in your own company and can rebuild and run a rolling deploy pretty easily. For someone pushing software to users all over the world, and as one of those users the downside to allow every application to be responsible for updating this stuff seems pretty steep.

Re:The modern packager’s security nightmare by bfrog on Sunday February 21, 2021 @06:26PM (#26218415)
Not anymore