4 ms·

I think the parent was saying that new releases would bring new features the end user may not want, in addition to something like a security fix for an included

I think the parent was saying that new releases would bring new features the end user may not want, in addition to something like a security fix for an included library. With shared libs, you can keep using an old version if it works for you, while still updating ssl to a fixed version (assuming api compat).

eropple 11y ago
This, precisely. If I have to compile YourApp 1.5 with YourTLSLib instead of just `apt-get upgrade`, I'm going to be sending you flaming karmic poop for your karmic doorstep. And not just new features--though SemVer is very often honored in the breach more than the observance--but breaking, sometimes undocumented changes (two Go projects, Packer and Terraform, both come to mind).
- kjksf 11y ago
  `apt-get upgrade` is not magic. Someone had to package the app for apt. Someone had to decide when to make a new release. The same can be done for a Go app and it'll be available via apt just as any other app. A fair comparison would be compiling a C/C++ app from sources vs. compiling Go app from sources and Go wins that contest easily.
  - eropple 11y ago
    It is, to my mind, much less likely that somebody goes through and recompiles and publishes every statically linked application in the Ubuntu repos the day that the inevitable critical bug is unearthed than somebody recompiling and publishing libimportantthing3. It is also much more likely that a "minor version bump" that happens to contain the dependency with the bug has regressions or new, untested-in-my-environment features that I must accept as the price of a Go application's upgrade unless I want to start playing with said application's vendored dependencies. Which I don't, which is why libimportantthing3 is a vastly superior choice for software I must use but do not want to adopt and care for.
  - hueving 11y ago
    You are missing the point. "apt-get upgrade" would just get the latest SSL lib and fix the vulnerability. You wouldn't be required to upgrade the core app in question.

eropple 11y ago

This, precisely. If I have to compile YourApp 1.5 with YourTLSLib instead of just `apt-get upgrade`, I'm going to be sending you flaming karmic poop for your karmic doorstep. And not just new features--though SemVer is very often honored in the breach more than the observance--but breaking, sometimes undocumented changes (two Go projects, Packer and Terraform, both come to mind).

kjksf 11y ago
`apt-get upgrade` is not magic. Someone had to package the app for apt. Someone had to decide when to make a new release. The same can be done for a Go app and it'll be available via apt just as any other app. A fair comparison would be compiling a C/C++ app from sources vs. compiling Go app from sources and Go wins that contest easily.
- eropple 11y ago
  It is, to my mind, much less likely that somebody goes through and recompiles and publishes every statically linked application in the Ubuntu repos the day that the inevitable critical bug is unearthed than somebody recompiling and publishing libimportantthing3. It is also much more likely that a "minor version bump" that happens to contain the dependency with the bug has regressions or new, untested-in-my-environment features that I must accept as the price of a Go application's upgrade unless I want to start playing with said application's vendored dependencies. Which I don't, which is why libimportantthing3 is a vastly superior choice for software I must use but do not want to adopt and care for.
- hueving 11y ago
  You are missing the point. "apt-get upgrade" would just get the latest SSL lib and fix the vulnerability. You wouldn't be required to upgrade the core app in question.