3 ms·
I like how they argue it would be less work to patch around the "out of date" message (and then maintain a fork) than to just update XScreenSaver. By Debian lo
by jmount 11y ago
I like how they argue it would be less work to patch around the "out of date" message (and then maintain a fork) than to just update XScreenSaver. By Debian logic wouldn't they have to wait forever to take their own patch? Or better you why don't they claim they have already patched it out- but it isn't in the distro just yet!
- awinder 11y agoNope, because patch code written by a bunch of package maintainers is obviously more trustworthy than code written by the original author. DUH! /sarcasm
- LoSboccacc 11y agoYup https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...
- icebraining 11y agoActually, the Debian maintainer that made the buggy patch is also a member of the OpenSSL dev team, so technically they are just as trustworthy :)
- icebraining 11y agoNo, a very small and inconsequential patch is much more likely to be accepted into Stable than a full package upgrade. Remember that the purpose of Stable is not to be bug-free, it's to avoid introducing uncertainty into the system - not only new bugs, but also new features or changed behaviors - hence why packages are usually frozen except for security bugs, or as in this case, stuff that is (practically) guaranteed to avoid introducing uncertainty.