3 ms·

Yes, that is what I mean.

• phkahler 4y ago
  That's not really their job. For log4j they could update that package. Any app that breaks as a result needs to be fixed upstream anyway, and then the distro can rebuild that. Fixes like that do get through the process, but it's not specifically the distros job to fix it. These problems are all about dependencies, which fall to upstream to make managable. If your favorite app breaks all the time it's probably because the code base is a giant mess. Oh, and some of the mess comes from too many different licenses in use, which prevents tighter integration of source code.
  • ticviking 4y ago
    That is the entire value dynamic linking and a stable ABI and API provide me. The ability to seamlessly replace an updated dependency by restarting an application and loading the library. If I'm just going to completely rebuild the app and all of it's dependencies I may as well statically link them and get the unique optimizations we can do after link time by analyzing the resulting executable.
  • cuu508 4y ago
    It's up to the distro to define what their job is. As I said, I prefer distros that proactively patch security issues regardless of what upstream does :-)
    • robertlagrant 4y ago
      Point being a log4j issue would be downstream of the distro, not upstream.
      • phkahler 4y ago
        The fix was to remove a feature from the library. That's upstream. That would also break things relying on the feature, so those apps would need to be fixed. That's also upstream. In each case, upstream WILL have to fix it. It's up to the distro whether they want to do anything about it prior to upstream getting it done.
        • robertlagrant 4y ago
          It's not upstream of the distro.