3 ms·
Recently I wanted to build one of Signal’s libraries so that I could use it with signal-cli. It astonished me that building this secure messenger requires autom
by Mediterraneo10 6y ago
Recently I wanted to build one of Signal’s libraries so that I could use it with signal-cli. It astonished me that building this secure messenger requires automatically downloading a whole host of third-party dependencies through wget from some disparate repositories, which presumably had received little vetting.
What happened to the notion of using stable, centralized package repositories like Debian’s or Red Hat’s in order to build one’s software? I did a lot of Free Software development in the early millennium, then was away from the scene for a few years, and when I came back this desire for convenience above all else really baffles me.
- EGreg 6y agoAt Qbix, we have built everything in-house and the few dependencies that we do pull in, we vetted and pinned the versions. People have criticized us for that in the past but if we are ever to get past trusting large, centralized entities for our server back ends, we need to make sure to kick the open source movement to the next level: https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2018/01/17/modern-security-practices-for-web-developers/ https://qbix.com/blog/2018/01/17/modern-security-practices-f...