4 ms·
Does this also delay delivery of security fixes? Is there an override mechanism for a log4j type event?
by mulmen 7mo ago
Does this also delay delivery of security fixes? Is there an override mechanism for a log4j type event?
- dist-epoch 7mo agoIt delays everything. You can manually override some packages, but the community can't push through it.
- mulmen 7mo agoRPM (YUM? DNF? RHEL?) lets me subscribe to security updates separately from updates. Does that concept exist in language distribution?
- 8n4vidtmkvmk 7mo agoI don't know how it would. Hackers would just claim everything is a security update. Unless maybe you give special permission to some trusted company to designate certain releases of packages they don't own are security patches... But that sounds untenable.
- cozzyd 7mo agoIt would have to be handled by the repository owner(e.g. PyPI) similar to how quarantines are done.