Re: [Letsencrypt-devel] Certbot in Debian Stretch
On 24/11/16 17:39, Adrian Bunk wrote:
> On Thu, Nov 24, 2016 at 05:22:29PM +0100, Daniel Pocock wrote:
>> ...
>> For networked services, it is different.
>>
>> Debian has already been carrying updated versions of Firefox and
>> Chromium in stable including bundled dependencies too. Maybe we need to
>> have an objective way of deciding which other projects genuinely deserve
>> the same treatment.
>> ...
>
> The problem with Firefox/Chromium is not "networked services".
>
> The problem is that it is not feasible to backport all security fixes
> to a 3 year old version of such a browser.
>
> And the "objective way of deciding" is that not shipping any web browser
> would not be a realistic option.
>
> For nearly any other package, not shipping it in a stable is the better
> option for Debian.
>
Why do you say it is the better option?
If a package is very useful and has made certain efforts to be stable
(e.g. not arbitrarily changing the command line syntax) and it is a leaf
package, maybe it is time to consider it?
The alternative is that more and more frequently, the user is tempted to
get things from upstream apt repositories. If many upstreams go down
that path and more users accept it as normal, the net result may be even
worse.
Regards,
Daniel
Reply to: