Hacker News new | ask | show | jobs
by ckastner 1541 days ago
This article is full of inaccuracies and errors.

> Due to the sheer size of the current Debian release it is infeasible for a small team to be able to audit all the packages, so there is a system of prioritizing packages which are more security sensitive.

This was, at best, poor communication. Of course nobody would ever audit all of 90,000 packages, easily billions of LOC. Especially not when the vast majority of these packages have a very small user base.

> The fact of the matter is that Debian has long been experiencing a decline in the amount of people willing to participate in the project.

The author is claiming an assertion of the fact. From a very recent thread "Is Debian sending people away" [1], there is no decline.

> Before that, Michael Larabel, the former leader had these ridicules points in focus for the future of Debian.

I don't know who they are, but they are not a former Debian Project Leader [2].

And so on.

[1] https://lists.debian.org/debian-project/2022/03/msg00037.htm...

[2] https://en.wikipedia.org/wiki/List_of_Debian_project_leaders

2 comments

>> Before that, Michael Larabel, the former leader had these ridicules points in focus for the future of Debian.

>I don't know who they are, but they are not a former Debian Project Leader [2].

That one at least appears to be a brainfart by the author; they meant Sam Hartman. Michael Larabel is the author of the Phoronix article about Sam Hartman.

>> Due to the sheer size of the current Debian release it is infeasible for a small team to be able to audit all the packages, so there is a system of prioritizing packages which are more security sensitive.

> This was, at best, poor communication. Of course nobody would ever audit all of 90,000 packages, easily billions of LOC. Especially not when the vast majority of these packages have a very small user base.

How is that any different? It rather sounds like you've restated the same thing and then claimed the author's wrong.

I think OP is trying to suggest that you'd only audit the packages you actually use rather than all packages.
The author didn't state that. That's a direct quote from the Debian page, from the "Audit Scope" section.

That statement is entirely reasonable, yet the author frames this as the the point where "things begin to spin out of control!".