Re:PEP 427 – The Wheel Binary Package Format 1.0
by lawnchair_larry on Saturday February 16, 2013 @10:12PM
(#5234047)
The drawback is that you are responsible for security vulnerabilities in the libraries you install.
That is a much larger problem than most people realize. It makes vulnerable dependencies fairly impossible to deal with.
If an OpenSSL bug comes out, I upgrade OpenSSL on all systems in my enterprise. Everything linked to it is automagically taken care of. If a vulnerable library is buried into jar files (or whatever equivalent in your language of choice), I'm screwed. You'll never find those, and there is no assurance that your systems are patched.
If I put on my developer or end-user hat, I totally agree with you. But for most software, this is dangerous.
That is a much larger problem than most people realize. It makes vulnerable dependencies fairly impossible to deal with.
If an OpenSSL bug comes out, I upgrade OpenSSL on all systems in my enterprise. Everything linked to it is automagically taken care of. If a vulnerable library is buried into jar files (or whatever equivalent in your language of choice), I'm screwed. You'll never find those, and there is no assurance that your systems are patched.
If I put on my developer or end-user hat, I totally agree with you. But for most software, this is dangerous.