2 ms·

We're talking about distro packages, not upstream software releases.

• throw0101c 2y ago
  > We're talking about distro packages, not upstream software releases. Yes, by "the MySQL package team" I meant the MySQL distro package team. Edited to clarify. But even if applied to the upstream team that releases from (e.g.) repo.mysql.org or repo.postgres.org it would apply: they're now worrying about all their dependencies as well their own code, instead of just specifying in the .deb or .rpm file "I need libssl3" and letting the OS take care of it. It would become a huge duplication of effort to keep up on security updates. At $JOB we have a general policy to always use the distro-supplied version of a package whenever possible, as if we compile it on our own and put it into /usr/local or /opt, we now have to babysit that code for security and such ourselves instead of 'outsourcing' it to the distro. Ain't nobody got time for that.