3 ms·

I feel like it's possible to be wrong about your definition of stable software though. Software is not like wine. It doesn't become better just from leaving it

by rossy 11y ago

I feel like it's possible to be wrong about your definition of stable software though. Software is not like wine. It doesn't become better just from leaving it alone for a few years. In fact, all software has bugs and developers are constantly struggling to fix them. In the case of a screen-locker like XScreenSaver, it's also security-critical software, so the developer(s) are constantly in a race against people who want to exploit the bugs. Using a version from 2014 instead of the latest stable version is not just a opinion/preference, it's a bad idea, and I think jwz is totally right in saying that it's better Debian don't package it at all than package an old version.

caf 11y ago
The Debian maintainers do backport security fixes to the older version they're shipping, though. Eg. for the package in question here we have: xscreensaver (5.30-1+deb8u1) jessie-security; urgency=medium * Add upstream patch for "xscreensaver aborts when unplugging second monitor" security issue (closes: #802914) http://www.openwall.com/lists/oss-security/2015/10/24/2 -- Tormod Volden <debian.tormod@gmail.com> Sun, 25 Oct 2015 11:35:52 +0100 Keeping the old version isn't supposed to imply "it has no bugs" - instead, it's based on the idea that "if if works for you now, it will continue to work for you". In other words, you can be reasonably sure distribution point updates won't break anything that you're relying on.
- vacri 11y ago
  Given that this is a saga that's been going on for years, I wonder why debian hasn't just put it into stable-backports?
  - ashitlerferad 11y ago
    You might want to read the response, there were no changes worth backporting.
ashitlerferad 11y ago
If you actually look at the changes to xscreensaver upstream (as the Debian xscreensaver maintainer did), you will see that most of the changes only mattered for iOS users so there was little point updating to the latest version, apart from the security fix, which was backported quickly.

by rossy 11y ago

caf 11y ago

The Debian maintainers do backport security fixes to the older version they're shipping, though. Eg. for the package in question here we have: xscreensaver (5.30-1+deb8u1) jessie-security; urgency=medium * Add upstream patch for "xscreensaver aborts when unplugging second monitor" security issue (closes: #802914) http://www.openwall.com/lists/oss-security/2015/10/24/2 -- Tormod Volden <debian.tormod@gmail.com> Sun, 25 Oct 2015 11:35:52 +0100 Keeping the old version isn't supposed to imply "it has no bugs" - instead, it's based on the idea that "if if works for you now, it will continue to work for you". In other words, you can be reasonably sure distribution point updates won't break anything that you're relying on.

vacri 11y ago
Given that this is a saga that's been going on for years, I wonder why debian hasn't just put it into stable-backports?
- ashitlerferad 11y ago
  You might want to read the response, there were no changes worth backporting.

ashitlerferad 11y ago

If you actually look at the changes to xscreensaver upstream (as the Debian xscreensaver maintainer did), you will see that most of the changes only mattered for iOS users so there was little point updating to the latest version, apart from the security fix, which was backported quickly.