“This version of XScreenSaver is very old. Please upgrade”

You sure you are running the latest version?

That is the origins of this message. That Debian (and perhaps other distros) would fail to push xscreensavers in a timely manner, resulting in JWZ getting emails about issues he had long since fixed.

This seems to stem from a policy that only security issues (resulting in a CVE being published) will be processed, while usability issues are left in place until the next major stable release is rolled out.

I can see two reason for this.

A: that the thinking around stable is heavily server oriented. Thus anything but CVEs being excluded result in reduced risk of production breakages. This even though Debian is a generic distro that can be molded into desktop or server usage depending on what gets installed.

B: that the rigidity of traditional package management do not allow a piecemeal updating process. This because updating a package removes the old package in the process. Thus if you want to bump up the xscreensaver version, and it hard depends on a newer lib somewhere in the dependency chain, you end up with an unresolvable conflict unless you also update everything else that depends on the same lib.

It is not the software writers' fault that your distro can't be arsed to keep its package system up-to-date.

Even the unstable branch is routinely multiple versions behind on software.

The idea of linking end-user software versioning to the operating system version itself was always a dumb idea, but has become even more absurd over time. No other operating system but Linux (and possibly some BSDs) does this to the extent that the distro model does.

I'm not limited to awkward work-around manual install methods just because the version of Notepad++ linked to Windows 8.1 hasn't been updated since it was released. The whole scenario is absurd.

Yes, package repos are nice, but not when it means I'm perpetually multiple versions behind on common software just because a handful of nerds are trying to do the job of Github and Sourceforge combined, instead of just building an easier method of installing and updating third-party software.

Of course, then I run into your B problem, where there isn't a really good way of installing your own versions that aren't in the repos. I was able to blacklist the kernel from updating itself, somehow, so I really just need to figure out how to do that again.

My worst experience with their repos was with logstash having a bug where it would annoyingly install logstash-web with an auto-start. But..... the package had a typo in its startup script and caused the JVM to restart over and over and over. This was at an HFT shop, so sure enough.. I got a call the next morning that all trading was stopped until it was fixed.

I don't understand how these sorts of things issues happen for so long on such a popular distro...

*arch is nice and all, but holy crap does AUR need some better standards with what's acceptable. After spending an asinine amount of time trying to figure out why every 5th package won't build where devs closing bug reports with, "Did you try $BASICTROUBLESHOOTING".. I'm pretty much done.