2 ms·
> Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657 https:
by madeofpalk 1y ago
> Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657 https://news.ycombinator.com/item?id=45169657
> Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing.
Immich is more immune to this issue because they wait 5 days before raising PRs to bump dependencies, which is a good practice https://github.com/immich-app/.github/blob/main/renovate-config.json#L10C3-L10C33 https://github.com/immich-app/.github/blob/main/renovate-con...
- rlpb 1y agoOK, more maybe, but that is nothing next to Debian, where a huge Debian userbase settles on a single set of versions for all dependencies for a year (usually more) at a time.
- madeofpalk 1y agoI would expect an operating system and a single application have a different approach to dependency management.
- rlpb 1y agoDebian is both an operating system and a distribution of single applications. Its (excellent) dependency management applies to both. It doesn't have a software supply chain problem because it takes dependency management seriously.