The modern packager’s security nightmare

Post by [deleted] » Thu, Feb 25, 2021, 11:16 AM UTC

progval wrote: post #222

mixedCase wrote: post #12

Yeah well, who's hungry? No really, neither users nor developers care, nor should they. I've been using Linux on the desktop for well over a decade and I'm tired of seeing this plea for everything to behave exactly like C or scripting languages because every distro wants to be its own special snowflake and it would be too hard to adapt. The world has changed and distros have to stop pretending it hasn't. Flatpak, Nix…

> I'm tired of seeing this plea for everything to behave exactly like C or scripting languages because every distro wants to be its own special snowflake and it would be too hard to adapt. The same argument can be used the other way around: "I'm tired of seeing this plea for everything to behave exactly like Docker or static .exe because every software wants to be its own special snowflake and it would be too hard to…

[deleted]

Post by posix_me_less » Fri, Mar 05, 2021, 11:16 AM UTC

delroth wrote: post #59

posix_me_less wrote: post #19

Here is the solution to this Debian/Gentoo/ packager's dilemma. Packagers realize that their numbers are small and they can't keep up fixing all the modern big software (BS) projects that go against their philosophy. They define the core of the OS that they can keep managing in this traditional way (kernel, basic userland, basic desktop, basic server services, basic libraries, security support for all that). "But peo…

You're making a distinction between "packagers" and "users" which does not exist. Packagers are advanced users that take the initiative to improve their distro when they find software they want to use and that isn't integrated in their distro. > Let the new complicated juggernaut software be deployed and configured by the users, according to developers' instructions, using whatever modern mechanism they prefer I'm no…

I meant ordinary users should rely on developers' defaults. If the user is advanced enough, he will be able to go his own way.

Yes I prefer the package manager too, when it works and gives me what I want. But for the software that changes fast, like new languages / compilers, or juggernaut software like Kubernetes, packagers can't keep up and I do not expect them to.

Re: The modern packager’s security nightmare

Re: The modern packager’s security nightmare