News for hackers. Stuff that matters.

A comment on The modern packager’s security nightmare. Parent comment

Re:The modern packager’s security nightmare by lmm on Monday February 22, 2021 @01:51AM (#26221581)
> And anyway, as a user, I don't care. I want my software to work, to be stable, and to not have security flaws; and if a security flaw is found, I want a fix to be pushed to me ASAP. The distro/maintainer/pm approach does that.

Not my experience at all. The distro maintainer generally takes significantly longer to push out a fix than the upstream developer.

[ Parent | on HN ]
Re:The modern packager’s security nightmare by pdonis on Monday February 22, 2021 @11:22AM (#26226284)
> The distro maintainer generally takes significantly longer to push out a fix than the upstream developer.

Of course this is true in a sense, because the distro maintainer has to wait for upstream to push a fix before they can package it.

However, for the upstream developer, "pushing a fix" means "pushing updated source code". For the distro maintainer, "pushing a fix" means "compiling the updated source code and packaging the resulting binaries for all supported versions".

There are some upstream developers who could probably accomplish the latter at least as fast as distros do, but not many. But the latter is what I, as a user, need.

[ Parent | on HN ]
Re:The modern packager’s security nightmare by lmm on Tuesday February 23, 2021 @08:09PM (#26245346)
My release builds makes binary packages (including a .deb) and push them to my artifact repository; isn't that normal?
[ Parent | on HN ]