4 ms·
> That's not a difference of security, only of download size (*). It is a difference of security, because now when there's an issue with (e.g.) OpenSSL, instea
by throw0101c 2y ago
> That's not a difference of security, only of download size (*).
It is a difference of security, because now when there's an issue with (e.g.) OpenSSL, instead of just the OpenSSL distro package team having to worry about it, the MySQL distro package team has to, the Postgres distro package team, Nginx, Apache, cURL, OpenSSH, etc.
All of those teams have to coordinate to release at the same time.
- Arnavion 2y agoWe're talking about distro packages, not upstream software releases.
- throw0101c 2y ago> We're talking about distro packages, not upstream software releases. Yes, by "the MySQL package team" I meant the MySQL distro package team. Edited to clarify. But even if applied to the upstream team that releases from (e.g.) repo.mysql.org or repo.postgres.org it would apply: they're now worrying about all their dependencies as well their own code, instead of just specifying in the .deb or .rpm file "I need libssl3" and letting the OS take care of it. It would become a huge duplication of effort to keep up on security updates. At $JOB we have a general policy to always use the distro-supplied version of a package whenever possible, as if we compile it on our own and put it into /usr/local or /opt, we now have to babysit that code for security and such ourselves instead of 'outsourcing' it to the distro. Ain't nobody got time for that.