debiandev

6 ms·

1.
by debiandev 5y ago
> Are distros doing anything more than scanning CVE databases with the library versions, or are they _actually_ auditing the versions they choose? Debian Developer here. Part of packaging work, for Python libraries or anything else, is t
2.
by debiandev 5y ago
This! Asciidoc is the grown-up brother of Markdown. Designed to scale up to entire books, handle images, tables, references, citation, book indexes, maths. And the syntax is very friendly and intuitive.
3.
by debiandev 5y ago
Debian Developer here. Reminder: the Debian Packaging Guidelines are meant for official Debian packages. Making a package with dpkg-deb -b <dir> <packagename> is very easy and gives all the features of APT (dependency tracking,
4.
by debiandev 6y ago
Debian Developer here: upstream developer almost never care to prepare fixes for existing releases.
5.
by debiandev 6y ago
This is good advice for software lifecycle management in general: https://wiki.debian.org/DontBreakDebian
6.
by debiandev 6y ago
Debian Developer here. Backporting fixes to tenths of thousands of packages is already a huge amount of (thankless) work. But it's still done - as long as there's usually one version of a given library in the whole archive. Imagin
7.
by debiandev 6y ago
Again, I'm talking about the article: "avoid drama and FUD" refers to HN. Especially the word "avoid", knowing that the article is already written. > In the meantime, I'd recommend reading the blog: in it a
8.
by debiandev 6y ago
I'm in no way responding to the blog, as you can see in my 4 points. I'm addressing the comments here. Every time similar content is shared here there's a number of people making exaggerated claims around Debian being dead
9.
by debiandev 6y ago
A couple of healthy reminders to avoid drama and FUD: 1) People announce leaving publicly and the FLOSS community takes notice of it. This is a sign of health of Debian. In many other projects few people notices. 2) The number of Debian dev
10.
by debiandev 6y ago
> the very real dangers of shipping blobs, which probably carries more weight than the dangers of vendoring you outline. This is a false dichotomy. > By not having that escape valve Please do your research before posting. Building pac
11.
by debiandev 6y ago
Debian Developer here. Some people take a very cursory look at Debian and assume the packaging is an exercise in masochism that we inflict on ourselves. And yet the number of DDs keeps increasing (and Debian is one of most successful projec
12.
by debiandev 6y ago
Correct. Furthermore, rebuilding and distributing a large number of large binaries every time a vulnerability is fixed is harmful! - It encourage users to delay security updates. Hundreds of millions in the world have slow or expensive or c
13.
by debiandev 6y ago
You are confusing static linking with embedding library sources.
14.
by debiandev 6y ago
Debian is available for the lucky PinePhone and PineTab owners, thanks to the Mobian project.
15.
by debiandev 6y ago
> weird poorly-documented helper scripts which have strange interactions I've never found a packaging tool without an extensive and clear manpage with examples. > I think the biggest issue is the social problem of the long and ar
16.
by debiandev 6y ago
Here are some answers: https://wiki.debian.org/ReproducibleBuilds/About
17.
by debiandev 6y ago
> No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. [citation needed] > And, what's more, the contracts we're talking about are all basically pro-forma. I had very
18.
by debiandev 6y ago
> AGPL is unchallenged in court. The risk to being wrong about it as huge. It’s risk aversion, not ideology, and it’s important to remember that identifying an argument as part of legal review does not call it the correct one. Anyone who
19.
by debiandev 6y ago
> After a couple of months with lawyers, it's now a major AGPL supporter I had a similar experience. I took exams on patent and copyright law with IP lawyers as teachers during my degree. Then I worked in well known tech companies a
20.
by debiandev 6y ago
> I was hoping that he would be able to just double click the .deb file and install with no hassle, but he couldn't. I don't know if was the package manager fault or google's And yet people praise Android for "inventi
21.
by debiandev 6y ago
It's been around since 13 years at least. I remember a website [1] that offered such installer. [1] https://web.archive.org/web/20160523181321/http://goodbye-mi...
22.
by debiandev 6y ago
huh?
23.
by debiandev 6y ago
DD here. The main "barrier" is the level of quality required. Simply throwing a bunch of files into a package or a container is very quick. Making an official Debian package is not supposed to be quick. DDs thoroughly review and t
24.
by debiandev 6y ago
DD here. apt-get install maint-guide ...and then read: file:///usr/share/developers-reference/index.html file:///usr/share/doc/maint-guide/html/index.en.html Also look a
25.
by debiandev 6y ago
...
26.
by debiandev 6y ago
> that they tend to take popcon statistics as evidence Please provide a source to back that claim.
27.
by debiandev 7y ago
...not to mention that (some) distributions do extensive security and legal compliance reviews...
28.
by debiandev 7y ago
That's what distributions are for. Just write software that is not unnecessarily difficult to package.
29.
by debiandev 7y ago
This is a reason for Debian to exists. Licenses cannot be reviewed automatically in a reliable way. Debian developers review the licenses and store them in a machine-parsable file.
30.
by debiandev 7y ago
And this is why Debian exists. When packaging we are required to disable privacy harming "features".

More ›