7 ms·
> Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using. If we made all builds repro
by gravypod 4y ago
> Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using.
If we made all builds reproducible (like oasis) we could setup an automated trusted system that does builds verifiably automatically (like what Nix has).
- goodpoint 4y agoThere are already trusted sources of software packages that provide security updates: traditional Linux distributions. Doing automated, local patching and rebuilding is far from enough. You need experts to correctly backport patches and test them thoroughly.
- bayindirh 4y agoNo, no… We need to move very fast, and break all the things. Tradition and conservatism is not the way. We need to compile everything and anything. Change the paradigm, break the status quo! Oh, just like Gentoo, Slackware and LFS. ;) Seriously, maybe we shouldn’t ignore history and learn why things are like this today.
- LtWorf 4y agoPeople bashing distributions seem to ignore that the alternative is the google play store.
- bayindirh 4y agoWhich reproducible builds project is striving to do for quite some time. It’s not just a simple switch you flick and recompile.