3 ms·
The conclusion I take from this is that distros need to be a lot more selective in what they package. If packagers can't reliably backport security fixes for th
by takluyver 11y ago
The conclusion I take from this is that distros need to be a lot more selective in what they package. If packagers can't reliably backport security fixes for the several years that a distro release is supported, they shouldn't create that expectation by putting the package in.
- stsp 11y agoOpenBSD purged many webapps from its ports tree one or two releaeses ago for this reason (too many security problems to keep up with). Most such packages didn't do much else than extracting .php files to somewhere in /var/www anyway. Users of such apps are now expected to do this themselves and keep track of updates.