3 ms·

They should just drop gsa. It's a vulnerability scanner. People interested in that and in its web fronted are supposed to have the skill to follow the instructi

They should just drop gsa. It's a vulnerability scanner. People interested in that and in its web fronted are supposed to have the skill to follow the instructions on GitHub and install those two pieces of software. One has a dockerfile, the other one must be built from source. It can probably run in a socket container with the correct dependencies. Problem solved. I use Debian on my laptop but in no way I'm using their vendored languages or packages except what's needed to run the OS. Everything else moves too fast. It's either language managers or docker containers. What I want from a distro is a solid foundation to run my desktop, editor and browser, then I care about everything else.

hedora 3y ago
The article suggests moving it to contrib, and having it download its stuff post-install. That seems completely reasonable. If it uses common npm libraries that don’t break api’s every few months, then those could be moved to stable. I’d rather libraries packaged by debian releases continue to work for more than 30 days than to have them package unsupportable dev packages that bitrots my dev environment every “apt get update”. It’s kind of amusing to me that there are so many comments saying this is unsustainable, given the fact that multiple BSDs maintain a quality bar similar to Debian’s.
NegativeK 3y ago
There are a number of benefits that come from letting the distro maintain a piece of software, such as unattended, or even just a unified UI for updates.
- pmontra 3y ago
  I know, but they are usually months or years behind. If a customer tells me that they are working with Language x.y.z I need to install that version, no matter what my distro gives me. And if a project is N versions ahead of the version in my distro, I usually install from either their own PPA or docker image. If I had one euro for every time I read something along the lines of "the version of our software available in Debian is terribly out of date, do not install it, it's full of bugs that we fixed on the last years plus new features. Follow our installation procedure instead."
  - tremon 3y ago
    Also known as "we want you to use our software, but we can't be arsed to spend a few dollars on a Debian maintainer".

hedora 3y ago

The article suggests moving it to contrib, and having it download its stuff post-install. That seems completely reasonable. If it uses common npm libraries that don’t break api’s every few months, then those could be moved to stable. I’d rather libraries packaged by debian releases continue to work for more than 30 days than to have them package unsupportable dev packages that bitrots my dev environment every “apt get update”. It’s kind of amusing to me that there are so many comments saying this is unsustainable, given the fact that multiple BSDs maintain a quality bar similar to Debian’s.

NegativeK 3y ago

There are a number of benefits that come from letting the distro maintain a piece of software, such as unattended, or even just a unified UI for updates.

pmontra 3y ago
I know, but they are usually months or years behind. If a customer tells me that they are working with Language x.y.z I need to install that version, no matter what my distro gives me. And if a project is N versions ahead of the version in my distro, I usually install from either their own PPA or docker image. If I had one euro for every time I read something along the lines of "the version of our software available in Debian is terribly out of date, do not install it, it's full of bugs that we fixed on the last years plus new features. Follow our installation procedure instead."
- tremon 3y ago
  Also known as "we want you to use our software, but we can't be arsed to spend a few dollars on a Debian maintainer".