5 ms·
> only updating if you know what the update contains People suck at this. What this actually tends to do is mean "no updates, ever" unless you have a particula
by UncleMeat 5y ago
> only updating if you know what the update contains
People suck at this. What this actually tends to do is mean "no updates, ever" unless you have a particularly rigorous culture of dependency management.
- xg15 5y agoOr we get a culture where upstream writes in more detail what an upstream is supposed to contain and downstream verifies that the update indeed does what they write. If this leads to fewer updates overall, I have no problem with that.
- tremon 5y agoIf you change "contain" to "do", then this is the MAC security model as implemented by SELinux. a culture where upstream writes in more detail what their code is supposed to do and downstream enforces that the software indeed does (not do anything beyond) what they specified It didn't lead to fewer updates, it led to less usage of SELinux.