3 ms·
Users/clients could expect to be able to upgrade minor OS/utility versions, but not direct dependencies. There's no reason to expect rogue upgrades of dependenc
by loopz 6y ago
Users/clients could expect to be able to upgrade minor OS/utility versions, but not direct dependencies. There's no reason to expect rogue upgrades of dependencies to work out of the box, unless explicitly guaranteed by subvendors ie. within minor versions. The modern approach is to encapsulate the complexity within a static binary, or even containers with more files. The deliverables are provided and guaranteed by the vendor. If there are security issues, 99% of that should rather be solved by safe language usage and security perimeter or encrypted channels, while refraining from unsafe library dependencies and direct connections to core business processes.
Linux packaging is interesting, since the delivery model of gratis distributions often have no such guarantees. Thus one may indeed experience difficulties at any moment after a recent upgrade due to that model. In that case, the complexity lies within upstream and distro, a shared responsibility that the distro should reconcile but may fail to do in minute detail.
Modern methods involve a pipeline, and no rogue upgrades that haven't passed multiple stages of tests and security checks.
- jfkebwjsbx 6y ago> There's no reason to expect rogue upgrades of dependencies to work out of the box If they don’t work, they are broken. Of course it can happen, but the opposite approach means never being able to do it. > If there are security issues, 99% of that should rather be solved by safe language usage and security perimeter or encrypted channels There is no mainstream language or operating system out there that solves "99% of security issues" unless you are talking about formally proven systems etc. > The deliverables are provided and guaranteed by the vendor. As I explained in the GP, this only happens for systems with support contracts. For most software out there, this isn’t the case. Mainstream software vendors don’t guarantee you anything at all, for good reasons. > Modern methods involve a pipeline, and no rogue upgrades that haven't passed multiple stages of tests and security checks. That is not "modern". That is how it has always been done since the 80’s. Again, for software properly supported. I am not sure why you talk about "rogue" updates, since nobody has mentioned such.