3 ms·
The "alternative" is exactly what Linux distros like RHEL and Debian do. They have editorial control over every package and often make changes the original deve
by kijin 5y ago
The "alternative" is exactly what Linux distros like RHEL and Debian do. They have editorial control over every package and often make changes the original developers don't like. It seems to work fairly well as long as you don't insist on following the latest version.
- seoaeu 5y agoOne mental model is that Linux distros are really just curated package repositories, with all the upsides and drawbacks that come with that. Especially regarding their dogmatic insistence that across the entire repository there's only a single (or at most several) versions of any given library
- prmoustache 5y agoAren't developers always using the same version and blindly downloading and running malicious code doing the same thing, running a single version? Only those were harmed. And by harmed it was just really a bunch of tests runs failing, I guess no production workload was impacted by that jerk move.
- sam0x17 5y agoRight, but my point is this code, in and of itself, really isn't malicious. It's only malicious in the context of "version XYZ used to do X, now it does Y". If you make versions indelible, you eliminate the potential for this to blow up as an issue.