3 ms·
True, I forgot to mention it. Debian does a particularly good job with security patching (better than Red Hat and Canonical, IMO).
by lima 9y ago
True, I forgot to mention it.
Debian does a particularly good job with security patching (better than Red Hat and Canonical, IMO).
- jancsika 9y agoMore to the point-- what's Debian policy on applying local patches in their packages? For example-- if you do it today on a core app/lib without consulting upstream is that enough to get your credentials revoked? I ask because Debian famously patched a library to quiet a valgrind memory error which resulted in their userbase generating predictable key material for a few years[1]. I trust them not to do that again (at least with libs that are obviously security related). But is there explicit policy in this regard? [1] https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...