[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Proposal for how to deal with Go/Rust/etc security bugs



On Jan 25, Wookey <wookey@wookware.org> wrote:

> Luca is quite right here. Ultimately this can only be fixed by these
> ecosystems understanding that software in these languages cannot be
> sensibly used in distributions until they support modularity and
> stability. The rust people make the excuse that they are 'too new' to
> define a stable ABI. That was fair enough for a while, but it's
> getting to be quite a thin excuse at this point. I think the real
The problem here is that many of these upstream developers actually see 
this as a feature: they are happy to not have "old versions" of their 
software shipped by distributions, because this way they can tell users 
to just download the latest pre-built binaries from github or an 
appimage and not care about supporting older releases.

And while this somehow often works for stand-alone desktop or web
applications, it is hell for daemons or other system services which need 
integration with the OS.

-- 
ciao,
Marco

Attachment: signature.asc
Description: PGP signature


Reply to: