4 ms·

> All decisions related to dependency choices fundamentally belongs with upstream. No. As a user I want dependency management (and all of software distribution

> All decisions related to dependency choices fundamentally belongs with upstream. No. As a user I want dependency management (and all of software distribution, to be honest) to be handled by the party that's best able to keep things working while at the same time keeping them secure. Linux distributions have a much, much better track record at that than most upstreams.

Gigachad 5y ago
I really doubt that the python libraries packaged by Debian are any more secure or stable than the latest release of those libraries. At best they just limit to breaking updates to once every few years when they update them. It’s essentially like version locking packages except some random Debian maintainer decides when it’s time to update.
- Denvercoder9 5y ago
  > I really doubt that the python libraries packaged by Debian are any more secure or stable than the latest release of those libraries. They are more stable because I can keep using the same version for two years, and I'm not being pushed to the latest version that has (intentional or unintentional) breaking changes every two months. Yes, there might be a bug or two in there that have since been fixed, but I very much prefer the failure I know over unexpected failures. They are secure because Debian (and distros like it) backport security fixes to their packages. You can argue about whether they do a good enough job keeping up with vulnerabilities, but at least I know that once I install the update from Debian, my machine is secure, and I don't have to wait for the upstream authors of all software on my machine to release updates that upgrade their dependency. > It’s essentially like version locking packages except some random Debian maintainer decides when it’s time to update. Yes, but version locking isn't my problem. The crucial difference is that distros pick a version and support those for years, while upstreams usually force you to use the latest version all the time to get security support. With distros _I_ get to decide when I upgrade, and the reduced frequency is a nice bonus. Having a single entity for all software on the system is also valuable, as there's just one tool to learn and one place to check for updates.
- goodpoint 5y ago
  The python libraries packaged by Debian are provably more secure or stable: they receive security backports while also not receiving feature updates. The combination of this 2 aspects is what provides better stability and better security. > It’s essentially like version locking packages except some random Debian maintainer decides when it’s time to update. Not at all.
  - maple3142 5y ago
    I am not sure if Debian can really keep give packages security updates without feature updates. For example, Debian packaged Chromium seems really outdated and having many unpatched CVEs: https://security-tracker.debian.org/tracker/source-package/chromium https://security-tracker.debian.org/tracker/source-package/c...
    - goodpoint 5y ago
      ...and it's being removed for that reason.
  - plorkyeran 5y ago
    That is not "provably more secure or stable". I think it's pretty safe to assume that maintainers backporting security fixes is more secure than just not updating at all, but even that isn't proven. It being more secure than updating is much more questionable, and is probably going to vary greatly between packages.
    - goodpoint 5y ago
      Citation needed. Not only Debian, but Red Hat, Suse, Canonical and others provide both free and paid security updates and many large companies are happy to pay quite a pretty penny for that.

Gigachad 5y ago

I really doubt that the python libraries packaged by Debian are any more secure or stable than the latest release of those libraries. At best they just limit to breaking updates to once every few years when they update them. It’s essentially like version locking packages except some random Debian maintainer decides when it’s time to update.

Denvercoder9 5y ago
> I really doubt that the python libraries packaged by Debian are any more secure or stable than the latest release of those libraries. They are more stable because I can keep using the same version for two years, and I'm not being pushed to the latest version that has (intentional or unintentional) breaking changes every two months. Yes, there might be a bug or two in there that have since been fixed, but I very much prefer the failure I know over unexpected failures. They are secure because Debian (and distros like it) backport security fixes to their packages. You can argue about whether they do a good enough job keeping up with vulnerabilities, but at least I know that once I install the update from Debian, my machine is secure, and I don't have to wait for the upstream authors of all software on my machine to release updates that upgrade their dependency. > It’s essentially like version locking packages except some random Debian maintainer decides when it’s time to update. Yes, but version locking isn't my problem. The crucial difference is that distros pick a version and support those for years, while upstreams usually force you to use the latest version all the time to get security support. With distros _I_ get to decide when I upgrade, and the reduced frequency is a nice bonus. Having a single entity for all software on the system is also valuable, as there's just one tool to learn and one place to check for updates.
goodpoint 5y ago
The python libraries packaged by Debian are provably more secure or stable: they receive security backports while also not receiving feature updates. The combination of this 2 aspects is what provides better stability and better security. > It’s essentially like version locking packages except some random Debian maintainer decides when it’s time to update. Not at all.
- maple3142 5y ago
  I am not sure if Debian can really keep give packages security updates without feature updates. For example, Debian packaged Chromium seems really outdated and having many unpatched CVEs: https://security-tracker.debian.org/tracker/source-package/chromium https://security-tracker.debian.org/tracker/source-package/c...
  - goodpoint 5y ago
    ...and it's being removed for that reason.
- plorkyeran 5y ago
  That is not "provably more secure or stable". I think it's pretty safe to assume that maintainers backporting security fixes is more secure than just not updating at all, but even that isn't proven. It being more secure than updating is much more questionable, and is probably going to vary greatly between packages.
  - goodpoint 5y ago
    Citation needed. Not only Debian, but Red Hat, Suse, Canonical and others provide both free and paid security updates and many large companies are happy to pay quite a pretty penny for that.