this post was submitted on 30 Mar 2024
1581 points (97.7% liked)

linuxmemes

21198 readers
97 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.

    • Please report posts and comments that break these rules!

    founded 1 year ago
    MODERATORS
    poopsmith@lemmy.world
    zephyr@lemmy.world
    rtxn@lemmy.world
    1581
    Backdoors (lemmy.ml)
    submitted 7 months ago by lemmyreader@lemmy.ml to c/linuxmemes@lemmy.world
    115 comments fedilink hide all child comments
     

    https://wetdry.world/@cyrus/112186279067271067

    you are viewing a single comment's thread
    view the rest of the comments
    [–] acockworkorange@mander.xyz 14 points 7 months ago (2 children)

    Do you really need to download new versions at every build? I thought it was common practice to use the oldest safe version of a dependency that offers the functionality you want. That way your project can run on less up to date systems.

    [–] baseless_discourse@mander.xyz 39 points 7 months ago* (last edited 7 months ago) (1 children)

    Most softwares do not include detailed security fixes in the change log for people to check; and many of these security fixes are in dependencies, so it is unlikely to be documented by the software available to the end user.

    So most of the time, the safest "oldest safe" version is just the latest version.

    [–] acockworkorange@mander.xyz 2 points 7 months ago* (last edited 7 months ago) (1 children)

    So only protects like Debian do security backports?

    Edit: why the downvote? Is this not something upstream developers do? Security fixes on older releases?

    [–] Kelly@lemmy.world 2 points 7 months ago

    Backports for supported versions sure,.

    That's why there is an incentive to limit support to latest and maybe one previous release, it saves on the backporting burden.

    [–] treadful@lemmy.zip 24 points 7 months ago (1 children)

    Okay, but are you still going to audit 200 individual dependencies even once?

    [–] acockworkorange@mander.xyz 1 points 7 months ago (1 children)

    That’s what the “oldest safe version” is supposed to address.

    [–] treadful@lemmy.zip 0 points 7 months ago (1 children)

    Because everything is labeled safe and unsafe, right?

    [–] acockworkorange@mander.xyz 1 points 7 months ago

    Your snark is tremendously conducive for a conversation. Go touch some grass.