I'm trying to figure out how to defend composite systems against both upstream and 3rd party retardation in the supply chain. I've been complaining for a while now, but September was the worst month in terms of complete fuckups that I've seen in 30+ years of FOSS. And 7 days into October, this month has already surpassed it.
The problem manifests from premature vuln publication (also in places like GHSA), through maintainers bugfixing symptoms instead of causes, to insufficient operator awareness post-release. This is tough.
I'm trying to figure out how to defend composite systems against both upstream and 3rd party retardation in the supply chain. I've been complaining for a while now, but September was the worst month in terms of complete fuckups that I've seen in 30+ years of FOSS. And 7 days into October, this month has already surpassed it.
The problem manifests from premature vuln publication (also in places like GHSA), through maintainers bugfixing symptoms instead of causes, to insufficient operator awareness post-release. This is tough.