2 ms·
>The author makes one big assumption - that the packaged code in Debian is better because it has been reviewed and vetted by someone competent. They do not mak
by Arnavion 3y ago
>The author makes one big assumption - that the packaged code in Debian is better because it has been reviewed and vetted by someone competent.
They do not make this assumption, and in fact state the opposite.
- nindalf 3y agoThey state that > They might decide to give the diff at least a cursory look, which is better than nothing. So yes, they do value the cursory review, which isn’t that useful. And they talk up the security benefit of only pulling in a subset of published updates, which is even more dubious. Contrast this with the approach that Google is taking here - https://opensource.googleblog.com/2023/05/open-sourcing-our-rust-crate-audits.html?m=1 https://opensource.googleblog.com/2023/05/open-sourcing-our-.... Actual, careful review of the code that anyone can take advantage of. And no limitation of having to choose one flavour of one OS. This review helps you audit your supply chain regardless of OS you’re developing and deploying on.
- Arnavion 3y agoYou read and quoted the third point. Now why you don't read and quote the first two?