6 ms·

The author makes one big assumption - that the packaged code in Debian is better because it has been reviewed and vetted by someone competent. If this was true,

The author makes one big assumption - that the packaged code in Debian is better because it has been reviewed and vetted by someone competent. If this was true, it would make this approach worthwhile, but I don't think it is. The author could have pointed to some data that demonstrates this, but didn't. I remain unconvinced. As far as I can tell, this is more about the feeling of security because of familiarity. I can completely understand why they would feel more comfortable using something they've successfully used for many years, but that feeling doesn't actually translate to improvements in security. There is a feeble attempt to suggest that slowing down the rate of change improves security, but I would prefer to have the latest versions of the language toolchain and libraries available immediately, so I can make a decision on what to use myself. If security actually needs to be addressed, it's going to be by paying maintainers and paying people to review dependencies. And that would likely be in the framework of PyPI/crates.io/npm, because none of them place constraints on where the code can be used, unlike using a single Linux distro's package manager.

Arnavion 3y ago
>The author makes one big assumption - that the packaged code in Debian is better because it has been reviewed and vetted by someone competent. They do not make this assumption, and in fact state the opposite.
- nindalf 3y ago
  They state that > They might decide to give the diff at least a cursory look, which is better than nothing. So yes, they do value the cursory review, which isn’t that useful. And they talk up the security benefit of only pulling in a subset of published updates, which is even more dubious. Contrast this with the approach that Google is taking here - https://opensource.googleblog.com/2023/05/open-sourcing-our-rust-crate-audits.html?m=1 https://opensource.googleblog.com/2023/05/open-sourcing-our-.... Actual, careful review of the code that anyone can take advantage of. And no limitation of having to choose one flavour of one OS. This review helps you audit your supply chain regardless of OS you’re developing and deploying on.
  - Arnavion 3y ago
    You read and quoted the third point. Now why you don't read and quote the first two?

Arnavion 3y ago

>The author makes one big assumption - that the packaged code in Debian is better because it has been reviewed and vetted by someone competent. They do not make this assumption, and in fact state the opposite.

nindalf 3y ago
They state that > They might decide to give the diff at least a cursory look, which is better than nothing. So yes, they do value the cursory review, which isn’t that useful. And they talk up the security benefit of only pulling in a subset of published updates, which is even more dubious. Contrast this with the approach that Google is taking here - https://opensource.googleblog.com/2023/05/open-sourcing-our-rust-crate-audits.html?m=1 https://opensource.googleblog.com/2023/05/open-sourcing-our-.... Actual, careful review of the code that anyone can take advantage of. And no limitation of having to choose one flavour of one OS. This review helps you audit your supply chain regardless of OS you’re developing and deploying on.
- Arnavion 3y ago
  You read and quoted the third point. Now why you don't read and quote the first two?