4 ms·

There are also security implications. Update one shared lib with a security patch and all applications that use it are now using a patched version.

posix_me_less 6y ago
This is very often repeated argument in favor of giving control over shared libraries to the distribution, but it is mostly distribution's marketing. In practice, most users don't really care about security. That very small portion of users who do care about security, don't wait 2 weeks or more for distribution to make fixes available, they fix it/mitigate it themselves as soon as possible. It is true that it is easier to fix one version of a library than 10 different versions. But if you need 10 different versions for different applications, you probably do not need to patch all 10 of them.
- ithkuil 6y ago
  Most people don't care about security ... until they do. Most people don't understand security and are not equipped with the necessary knowledge to correctly judge risk. As long as security is just something that gets in the way to get some job done, most people will just plow ahead, since not getting the job done right now has a high and easy to understand cost.
brundolf 6y ago
It's become increasingly common for desktop applications to aggressively and/or automatically update themselves the same way the OS does, often without even having to go through a "wizard" prompt of any kind. Off the top of my head Chrome, Firefox, VSCode, and Slack (probably my four most-used non-system applications) automatically update themselves whenever I restart them (and prompt me to do so when applicable). Not to mention the fact that an increasing fraction of consumer-facing software now lives in the browser, where updating implicitly happens every time you go to use it. Regardless of how you feel about these trends, they make out-of-date applications much less of a concern than they used to be.

posix_me_less 6y ago

This is very often repeated argument in favor of giving control over shared libraries to the distribution, but it is mostly distribution's marketing. In practice, most users don't really care about security. That very small portion of users who do care about security, don't wait 2 weeks or more for distribution to make fixes available, they fix it/mitigate it themselves as soon as possible. It is true that it is easier to fix one version of a library than 10 different versions. But if you need 10 different versions for different applications, you probably do not need to patch all 10 of them.

ithkuil 6y ago
Most people don't care about security ... until they do. Most people don't understand security and are not equipped with the necessary knowledge to correctly judge risk. As long as security is just something that gets in the way to get some job done, most people will just plow ahead, since not getting the job done right now has a high and easy to understand cost.

brundolf 6y ago

It's become increasingly common for desktop applications to aggressively and/or automatically update themselves the same way the OS does, often without even having to go through a "wizard" prompt of any kind. Off the top of my head Chrome, Firefox, VSCode, and Slack (probably my four most-used non-system applications) automatically update themselves whenever I restart them (and prompt me to do so when applicable). Not to mention the fact that an increasing fraction of consumer-facing software now lives in the browser, where updating implicitly happens every time you go to use it. Regardless of how you feel about these trends, they make out-of-date applications much less of a concern than they used to be.