4 ms·
While I welcome the move to a Nix-like transactional package management system, the notion of "bundle everything in your app" leaves me extremely queasy. How ar
by mercurial 12y ago
While I welcome the move to a Nix-like transactional package management system, the notion of "bundle everything in your app" leaves me extremely queasy. How are you going to guarantee that individual application developers update insecure versions of bundled third-party libraries in a timely manner?
- lamby 12y agoIndeed. Somewhat related, but here's Debian's list of embedded code copies: https://anonscm.debian.org/viewvc/secure-testing/data/embedded-code-copies?view=co https://anonscm.debian.org/viewvc/secure-testing/data/embedd... Lots of these have colourful/active security histories (esp. poppler, zlib, pcre, libpng...)