4 ms·
So how you plan to fix security holes in flatpak aps, please? Static bundling predates UNIX. It's long known nightmare. New developers are not familiar with st
by lisivka 10y ago
So how you plan to fix security holes in flatpak aps, please?
Static bundling predates UNIX. It's long known nightmare. New developers are not familiar with static bundling, so they thinking that they are «moving forward».
- colemickens 10y agoThe same way you solve this anyway, or the same answer you should hear when people say "how do you handle security with Docker": Continuous Integration.
- lisivka 10y agoCI and maintenance are different things. AFAIK, it's recommended to pin versions of libraries, not to update libraries at every integration, so security fixes will be delayed. Moreover, developers never release new version of an app when a dependency is updated only, while maintainers do. It's called bit rot.
- colemickens 10y agoTake NixOS as an example. When libc gets a security fix, everything is automatically rebuilt and binary cache packages are available for users.
- lisivka 10y agoIt's waste of resources. Fedora does mass rebuild once per 3 months at average. If libc gets a security fix, dnf in Fedora will download just a delta between packages. Lower consumption of resources mean faster turn-over rate and is better overall. But I can mimic NixOS behavior with mock (tool for clean rebuilds) and chroots or containers, if I want.