4 ms·
There’s also other security considerations. As an operator or builder, do you want to patch a library (say OpenSSL) to keep your system up to date or patch ever
by jonhohle 3y ago
There’s also other security considerations. As an operator or builder, do you want to patch a library (say OpenSSL) to keep your system up to date or patch every binary. If changing a dependency requires rebuilding all consumers recursively, the there’s not a huge benefit.
- aidenn0 3y agoI think in the specific case of security issues, more bugs have been fixed by upgrading dynamic dependencies than introduced. That's just my gut feeling though, and I'd like to see data.
- rewmie 3y ago> I think in the specific case of security issues, more bugs have been fixed by upgrading dynamic dependencies than introduced. That's just your personal assertion, which is entirely baseless and unsubstantiated. It's ok to have beliefs, but instead of pushing them as truths you should at least start by doing some cursory research to see if they are even plausible. And yours isn't.
- klysm 3y agoHe qualified it saying it was a hunch… I don’t see where he pushed it as a truth
- aidenn0 3y agoIt's not entirely unsubstantiated, as my experience is that the former is very common. The latter is much harder to observe though, so it's just an impression. I'm very interested in your assertion that my impression is implausible though. What evidence do you have?