3 ms·
> They, and most others, have been doing that since their respectively beginnings As I explained on another comment of mine (https://news.ycombinator.com/item?
by cesarb 2y ago
> They, and most others, have been doing that since their respectively beginnings
As I explained on another comment of mine (https://news.ycombinator.com/item?id=41409199 https://news.ycombinator.com/item?id=41409199), it's not since their beginning, but since a particular zlib security incident which showed them the risks of vendored libraries. Any discussion of vendoring policy which does not consider that incident is necessarily incomplete.
- brnt 2y agoHow long ago was that? And did they quantify the problem?
- koverstreet 2y agoThat's very nearly a solved problem at this point; I get notified by bots (github, mainly) if a dependency has as a security vulnerability, and then it's very nearly a one click action to do a cargo update and commit the new lockfile. The distro people could've been working on the tooling for automating this at the distro level (and some people in debian are doing work that would enable this); we don't need to go this insane "unbundle everything" route.
- brnt 2y agoBefore broadband, and before forges like github with free CI and bots, which is all fairly recent, distros packaged everything was a godsend, not insane.