4 ms·
Staging the packages in experimental then testing, sometimes for months, before going to stable, is doing also a lot against this kind of threats. Which leads
by henearkr 4y ago
Staging the packages in experimental then testing, sometimes for months, before going to stable, is doing also a lot against this kind of threats.
Which leads me to wonder: do we really always want the very latest version or the packages? Any slightly older version will be immune to dependency-poisoning, thanks of the scrutiny of users over several weeks.
- usrnm 4y ago> Which leads me to wonder: do we really always want the very latest version or the packages? Not really, but then someone needs to decide what version to use and when/how this version is updated. For every single dependency. I agree that keeping track of your dependencies and actually managing them may be better engineering but it's a lot of work not many people want to do