3 ms·
Could you give a reference for that rationale? That does not seem to be the right lesson to be learned. They need to watch out for security holes and prepare f
by effie 7y ago
Could you give a reference for that rationale?
That does not seem to be the right lesson to be learned. They need to watch out for security holes and prepare fixes for both bundled lib and shared lib model.
The more likely reason for that change seems that it is less work to update single package than all packages. But this increases security risk, because now you're running obsolete versions of those other packages.
- cesarb 7y agoI don't recall where the original discussions following the zlib incident were, but here is the current rationale from one major distribution: https://fedoraproject.org/wiki/Bundled_Libraries https://fedoraproject.org/wiki/Bundled_Libraries
- effie 7y agoThanks, this confirms my impression - the distributions are prone to think "we want to organize the software, but keeping up-to-date upstream software is too much work, so we'll use shared libraries and freeze everything to older versions". Which I understand as a pragmatic solution, but it is far from clear that this gives users more security.