Re:The modern packager’s security nightmare
by pdonis on Monday February 22, 2021 @12:34AM
(#26221225)
As a user, my response is simple: I don't use software that's built that way. Outside of code that I write myself, I simply refuse to use software that's not accompanied by a distribution and maintenance infrastructure that I trust. For most software, that means it's packaged by my distro. Some big players might be able to convince me to take their software from them directly, but they will be very few, because there are very few big players that are as reliable as my distro, and that's the standard they have to meet.
[ Parent
| on HN ]
Re:The modern packager’s security nightmare
by secabeen on Monday February 22, 2021 @12:53AM
(#26221314)
> Outside of code that I write myself, I simply refuse to use software that's not accompanied by a distribution and maintenance infrastructure that I trust. For most software, that means it's packaged by my distro.
Okay, that's a reasonable approach, but with distros essentially saying for new software, they can't continue to maintain that standard, and they're just taking software as it comes, without securing it. I think you will find that there are lots of small utility programs and libraries that you won't have available to you in 10 years with this approach. YMMV.
Re:The modern packager’s security nightmare
by pdonis on Monday February 22, 2021 @01:07AM
(#26221371)
> I think you will find that there are lots of small utility programs and libraries that you won't have available to you in 10 years with this approach.
Then I'll either find an alternate source that has enough reliability to satisfy me, or write them myself, or do without.
(Or I'll end up building what amounts to my own distro. Which is something I have indeed thought of doing, because my preferences are rather idiosyncratic.)