3 ms·
> the security argument is moot anyways Sorry, I’m missing something, what security concerns are you referring to?
by eigenspace 3y ago
> the security argument is moot anyways
Sorry, I’m missing something, what security concerns are you referring to?
- chaosite 3y agoIf each package vendors its own deps, when the dep has a security vulnerability and needs an upgrade you need to hunt down every last location it exists in, instead of updating the single shared system dep and being done with it.
- somsak2 3y agowe just need better tooling for upgrading the individual locations. something like GitHubs dependabot
- nsajko 3y agoApart from what sibling said, another issue is explosion of trust assumptions. On my system, I obviously have to trust the Archlinux project not to serve me malware. When using Julia, I additionally have to trust the Julia project not to serve me malware. (See also: Python, Node, etc.) Obviously: less trust is better for security, ideally almost all installed software would be signed by Archlinux maintainers. For comparison, the situation is kind of similar for Apple users; but on Windows, trust is extremely watered-down anyway (with or without Julia or Python etc.).