3 ms·
> my understanding is Debian could package every version variant unlike pypi, debian patches CVEs, so having 3000 copies of the same vulnerability gets a bit c
by LtWorf 2y ago
> my understanding is Debian could package every version variant
unlike pypi, debian patches CVEs, so having 3000 copies of the same vulnerability gets a bit complicated to manage.
Of course if you adopt the pypi/venv scheme where you just ignore them, it's all much simpler :)
- woodruffw 2y agoThis is incorrect on multiple levels: * Comparing the two in this regard is a category error: Debian offers a curated index, and PyPI doesn't. Debian has a trusted set of packagers and package reviewers; PyPI is open to the public. They're fundamentally different models with different goals. * PyPI does offer a security feed for packages[1], and there's an official tool[2] that will tell you when an installed version of a package is known to be vulnerable. But this doesn't give PyPI the ability to patch things for you; per above, that's something it fundamentally isn't meant to do. [1]: https://docs.pypi.org/api/json/#known-vulnerabilities https://docs.pypi.org/api/json/#known-vulnerabilities [2]: https://pypi.org/project/pip-audit/ https://pypi.org/project/pip-audit/
- LtWorf 2y agoIt's a completely fair comparison is one is assessing which is more secure. The answer is completely straightforward. One project patches/updates vulnerable software and makes sure everything else works, while the other puts all the effort on the user.