The security team got used to c/c++ being the only way to build native binaries, and would prefer to peg other square languages into this round hole.
FUD enuses.
Re:Orphaning bcachefs-tools in Debian
by tsimionescu on Saturday August 31, 2024 @12:54PM
(#41410138)
How does it patch all versions automatically? If the library has been refactored, you still need to modify the patch for the pre-refactor and the post-refractor versions, for example. The closest you might get is a ChatGPT-based tool, but that is nowhere near safe enough for security patches.
Re:Orphaning bcachefs-tools in Debian
by hamandcheese on Sunday September 01, 2024 @04:16PM
(#41419993)
I didn't say it's automatic. You can have overrides that target a more narrow range of versions, if you need. If there has been a major refactor, then you need two patches. It's not rocket science, and you definitely don't need chatgpt.
You can also blend both strategies - you have have a version minimization strategy, where you only use, for example, one major version of a library at a time.
Take Nixpkgs, for example. They have this concept called "default crate overrides" which their rust builder uses, which offers the capability to patch all versions of a crate. That's not to say that Nixpkgs does rust perfectly, but just an example of the sort of tooling a security team should have at their disposal.