3 ms·

> We still deal with security issues I don’t see your point. In fact, you’ll most likely find that distros that follow upstream closer than “slow and stable re

• Foxboron 6y ago
  This assumes an ideal upstream: This is not always the case. If someone publishes a CVE for a Go or Rust library it's not always the case the project is well maintained or the dev cares to update the dependency. Even if they did, there are no guarantees the upstream decides to publish a minor release just to update dependencies. Because that is what vendoring dependencies get you. Instead of applying one patch to a shared library I'd need to hunt down all upstreams utilizing the library and manually patch between 10-140 packages independently and submit them upstream.
  • symlinkk 6y ago
    If upstream is not keeping their software up to date, why are you using that software? Imagine if Google stopped updating Chrome. Would you keep using Chrome?
    • Foxboron 6y ago
      Traditionally package maintainers has kept dependencies up to date. This has changed with vendored dependencies where upstreams have to do the work. They are not always up for that work. This isn't strange, nor weird and the comparison to chrome and google doesn't make much sense.
• drran 6y ago
  > will get their patches as soon as upstream fixes them i.e. never. Lot of upstreams are abandoned with tons of PR's waiting years for somebody to merge in.