| ▲ | dmitrygr 4 hours ago | ||||||||||||||||
your link disproves your claim. no naive app depended on xz version >= latest. Most sane distros take time to up-rev. That is why the xz backdoor was, in fact, in NO stable distro And not changing often is a feature, yes. | |||||||||||||||||
| ▲ | woodruffw 3 hours ago | parent [-] | ||||||||||||||||
I don't think it does; I think the industry opinion on xz is that we got lucky in terms of early detection, and that we shouldn't depend on luck. (I don't know what a "sane" distro is; empirically lots of distros are bleeding-edge, so we need to think about these things regardless of value judgements.) | |||||||||||||||||
| |||||||||||||||||