News for hackers. Stuff that matters.

A comment on Immich – High performance self-hosted photo and video management solution. Parent comment

Re:Immich – High performance self-hosted photo and video man... by madeofpalk on Monday September 08, 2025 @06:09PM (#45174679)
> Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657

> Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing.

Immich is more immune to this issue because they wait 5 days before raising PRs to bump dependencies, which is a good practice https://github.com/immich-app/.github/blob/main/renovate-con...

[ Parent | on HN ]
Re:Immich – High performance self-hosted photo and video man... by rlpb on Tuesday September 09, 2025 @12:11PM (#45184109)
OK, more maybe, but that is nothing next to Debian, where a huge Debian userbase settles on a single set of versions for all dependencies for a year (usually more) at a time.
[ Parent | on HN ]
Re:Immich – High performance self-hosted photo and video man... by madeofpalk on Tuesday September 09, 2025 @12:47PM (#45184688)
I would expect an operating system and a single application have a different approach to dependency management.
[ Parent | on HN ]
Re:Immich – High performance self-hosted photo and video man... by rlpb on Tuesday September 09, 2025 @02:26PM (#45186304)
Debian is both an operating system and a distribution of single applications. Its (excellent) dependency management applies to both. It doesn't have a software supply chain problem because it takes dependency management seriously.
[ Parent | on HN ]