Re:The modern packager’s security nightmare
by symlinkk on Monday February 22, 2021 @09:53AM
(#26225165)
If upstream is not keeping their software up to date, why are you using that software? Imagine if Google stopped updating Chrome. Would you keep using Chrome?
[ Parent
| on HN ]
Re:The modern packager’s security nightmare
by Foxboron on Monday February 22, 2021 @12:21PM
(#26227160)
Traditionally package maintainers has kept dependencies up to date. This has changed with vendored dependencies where upstreams have to do the work. They are not always up for that work. This isn't strange, nor weird and the comparison to chrome and google doesn't make much sense.