News for hackers. Stuff that matters.

A comment on The modern packager’s security nightmare. Parent comment

Re:The modern packager’s security nightmare by secabeen on Sunday February 21, 2021 @11:54PM (#26221002)
> And anyway, as a user, I don't care. I want my software to work, to be stable, and to not have security flaws; and if a security flaw is found, I want a fix to be pushed to me ASAP. The distro/maintainer/pm approach does that. If instead I have umpteen zillion different statically linked applications installed, each of which packages all of its own dependencies, then instead of just relying on my distro to push security fixes to shared libraries that everyone uses, I have to rely on every single one of those developers to do it for their own packages. And most of them won't do it, or they'll do it when they get around to it instead of when I, the user, need it.

This is my main worry as well. We are currently in the early, easy, period of this new development paradigm, where developers are constantly releasing new code, and fixes are easy to deploy. I worry that in 10 or 15 years, when a security bug is found in a critical imported function, the developers aren't going to be around anymore to fix them, they will have moved on to the next new, hot, language, and will have as much interested in maintaining their old Go/Rust code as developers today do in maintaining their old C code.

[ Parent | on HN ]
Re:The modern packager’s security nightmare by pdonis on Monday February 22, 2021 @12:34AM (#26221225)
As a user, my response is simple: I don't use software that's built that way. Outside of code that I write myself, I simply refuse to use software that's not accompanied by a distribution and maintenance infrastructure that I trust. For most software, that means it's packaged by my distro. Some big players might be able to convince me to take their software from them directly, but they will be very few, because there are very few big players that are as reliable as my distro, and that's the standard they have to meet.
[ Parent | on HN ]
Re:The modern packager’s security nightmare by secabeen on Monday February 22, 2021 @12:53AM (#26221314)
> Outside of code that I write myself, I simply refuse to use software that's not accompanied by a distribution and maintenance infrastructure that I trust. For most software, that means it's packaged by my distro.

Okay, that's a reasonable approach, but with distros essentially saying for new software, they can't continue to maintain that standard, and they're just taking software as it comes, without securing it. I think you will find that there are lots of small utility programs and libraries that you won't have available to you in 10 years with this approach. YMMV.

[ Parent | on HN ]
Re:The modern packager’s security nightmare by pdonis on Monday February 22, 2021 @01:07AM (#26221371)
> I think you will find that there are lots of small utility programs and libraries that you won't have available to you in 10 years with this approach.

Then I'll either find an alternate source that has enough reliability to satisfy me, or write them myself, or do without.

(Or I'll end up building what amounts to my own distro. Which is something I have indeed thought of doing, because my preferences are rather idiosyncratic.)

[ Parent | on HN ]