3 ms·
Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. And as far as I know, only L
by Svenstaro 12y ago
Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. And as far as I know, only Linux distro package repositories even have backports, not application package repos.
- zimbatm 12y agoThere's value in having automatic system updates for the common base. Once you go on the road of unsupported libraries that would be bundled with your application more work is involved for upgrades. Even with semantic versioning you depend on the author to do it properly. It's best if upgrades can be controlled to avoid regressions.
- e12e 12y ago> Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. Not necessarily. There's great value in having stable "long time support" versions of libraries, that are not the latest version, but often have backported security fixes. New features introduce new bugs, some (most?) new bugs will be (new) security issues. [ed: For a new application, tracking upstream is often the best way -- say you assume to have a stable(ish) release of your application in 6 months, you don't want to miss out on new features that'll be available in a supported release of some library you're using. But it doesn't follow that you should always migrate to the latest release of that library.]