> "unnecessary code adds to both vulnerability surface & footprint" I wholeheartedly agree with this. If there is unnecessary code, there's no reason to keep

> "unnecessary code adds to both vulnerability surface & footprint" I wholeheartedly agree with this. If there is unnecessary code, there's no reason to keep it. I'm more directing my gripes towards packages that have highly desirable, well-audited add-ons / modules that package maintainers choose not to include in the default distributions (under the reasoning that "users want small binaries"). Take for example nginx, caddy, certbot, or postfix (there are many others too). All of these require recompiling from source with build flags to enable the inclusion of even their most common add-on modules, e.g. nginx_http_lua_module, nginx_http_perl_module, caddy:http.cache, cerbot dns plugins, etc. Recompiling from source breaks the ability to use a package manager for install and automated updates, which drastically reduces usability for the majority of users. There are ways around this of course, but for the average user, having to compile a package from source is a major hurdle. Instead, why not distribute the binary with no add-ons as "apt install packagename-minimal" for the users with bad internet / low-resource requirements, and make the default "apt install packagename" distribution the "batteries included" version? (If you're interested, here's an old blog post of mine that goes into detail on why I think package manager distributions are worth the effort to maintain in general, even for static binaries or packages with dylibs: https://docs.sweeting.me/s/against-curl-sh https://docs.sweeting.me/s/against-curl-sh)