[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAH8yC8n4BiR+o8hJOZWCFNcP+-2CPFqkWRm=z2760_vKgt0Eog@mail.gmail.com>
Date: Wed, 25 Jan 2017 16:48:04 -0500
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Windows ports of Linux software bundling outdated
libraries (Gajim / PyCurl)
> tl:dr; use Fedora or OpenSuse and their mingw-w64* packages to
> cross-compile and package from Linux; if you use Windows or OS X or
> anything else, use one of these in a VM.
Maven and Git are noteworthy here.
Maven was infamous for outdated packages. Confer, "The Vulnerability
Dataset of a Large Software Ecosystem",
http://bkarak.wizhut.com/www/pubs/pdfs/badgers2014.pdf.
Git took it to the next level and made it distributed. Instead of one
outdated repo like Maven, we now have hundreds or thousands of
outdated followers who don't pulll from master.
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
