5 ms·

You would have to do that anyway. With static linking, you also have to rebuild those dependents and make sure their users update them as well.

Wowfunhappy 5y ago
I would rather the developers rebuild the dependents, test them, make any necessary fixes, and send me the updated (presumably static) binaries. As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong.
- ris 5y ago
  And if the upstream developers are unresponsive, or only provide the bump with the latest bleeding-edge version which you can't upgrade to yet?
  - Wowfunhappy 5y ago
    On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer, it could be some other organization analogous to a distro maintainer. What matters is that someone who is familiar with the software and code base has actually tested the update in a purposeful way.
- AussieWog93 5y ago
  As a small developer who handles my own support, I agree with this sentiment completely!!
- xg15 5y ago
  You'll have the opposite problem though, that you have to trust every single developer to properly manage their dependencies and publish timely patches if there is a vulnerability. > As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong. Wouldn't this be the task of your distro's mainteners, not you? (Who will have familiarity with all codebases as well as options to contact the original developers if there is an unsolvable issue)
  - Wowfunhappy 5y ago
    > Wouldn't this be the task of your distro's mainteners, not you? Sure, and when they’re done, they can recompile the static binary and send me an updated copy. I don’t want to update until they’ve finished testing the dependents. At least with static binaries, I can update some of the dependents sooner as the maintainers work through their lists.

Wowfunhappy 5y ago

I would rather the developers rebuild the dependents, test them, make any necessary fixes, and send me the updated (presumably static) binaries. As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong.

ris 5y ago
And if the upstream developers are unresponsive, or only provide the bump with the latest bleeding-edge version which you can't upgrade to yet?
- Wowfunhappy 5y ago
  On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer, it could be some other organization analogous to a distro maintainer. What matters is that someone who is familiar with the software and code base has actually tested the update in a purposeful way.
AussieWog93 5y ago
As a small developer who handles my own support, I agree with this sentiment completely!!
xg15 5y ago
You'll have the opposite problem though, that you have to trust every single developer to properly manage their dependencies and publish timely patches if there is a vulnerability. > As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong. Wouldn't this be the task of your distro's mainteners, not you? (Who will have familiarity with all codebases as well as options to contact the original developers if there is an unsolvable issue)
- Wowfunhappy 5y ago
  > Wouldn't this be the task of your distro's mainteners, not you? Sure, and when they’re done, they can recompile the static binary and send me an updated copy. I don’t want to update until they’ve finished testing the dependents. At least with static binaries, I can update some of the dependents sooner as the maintainers work through their lists.