undefined | Better HN

0 pointsbenlivengood1y ago0 comments

Having a distribution maintainer provide official packages is the best way.

0 comments

Thats who pushed XZ out as far as it went.

Everyone is asleep at the wheel.

Distribution maintainers are also the people that pushed out a fix as quickly as the compromised version was released.

It's unrealistic to expect software to never have security holes, bugs, or vulnerabilities. How they're handled matters more than the fact that they were introduced to begin with.

arp2421y ago

A single incident. How many incidents in how many decades have there been?

zer00eyz1y ago

Ask the bottles team how they feel about maintainers and the job they are doing.

A fair number of upstream developers are unhappy with what maintainers and how they deal with bugs and updates.

The real problem is that software packaging and distribution is so very broken. I had a systems admin say "I love containers, they are a circle of salt around demonically bad software"... He wasnt wrong.

Hamuko1y ago

I thought that the xz backdoor was only in bleeding edge distributions?

j / k navigate · click thread line to collapse

0 comments

zer00eyz1y ago

Thats who pushed XZ out as far as it went.

Everyone is asleep at the wheel.

jakogut1y ago

Distribution maintainers are also the people that pushed out a fix as quickly as the compromised version was released.

It's unrealistic to expect software to never have security holes, bugs, or vulnerabilities. How they're handled matters more than the fact that they were introduced to begin with.

arp2421y ago

A single incident. How many incidents in how many decades have there been?

zer00eyz1y ago

Ask the bottles team how they feel about maintainers and the job they are doing.

A fair number of upstream developers are unhappy with what maintainers and how they deal with bugs and updates.

Hamuko1y ago

I thought that the xz backdoor was only in bleeding edge distributions?

j / k navigate · click thread line to collapse