Re: Anti-bundling materials

[Jason Bacon <outpaddling%yahoo.com@localhost>]

On 8/21/21 12:33 PM, J. Lewis Muir wrote:
> As you said, this practice "leads to security issues and other bugs that
> are difficult to fix because the software uses an outdated API."  I'm
> not sure what you mean by "difficult to fix because the software uses an
> outdated API" (I would think that would actually make the software more
> likely to keep working because it has bundled the library with the API
> that it uses), but in general, the exact same issues, and more outlined
> in some of the resources you posted upthread, exist for the 99% that are
> not being addressed.

What I'm saying here is the bundled library *is* the problem since it 
has known vulnerabilities or bugs, and we can't just hack the build 
system to use an up-to-date replacement from pkgsrc since the API is 
different.  There is one such tool I won't name that bundles an outdated 
SSL library, which people are using to process private health information.