Jesus Michał von Gentoo 🏔 (he) on Nostr: Err, so there's this systemic problem that a lot of people are running software on ...

Err, so there's this systemic problem that a lot of people are running software on systems with lots of outdated or missing packages that cannot be upgraded or installed for a variety of reasons: lack of (up-to-date) distribution packages, lack of root access, dependency conflicts, but also badly written libraries with unstable API/ABI, too aggressive deprecation schedules and software not being kept up to date.

Unfortunately, rather than attempting to address the systemic problem, a lot of software developers have embraced workarounds to make their users' lives easier, and they started bundling everything. When you bundle something, your users don't need to have it installed. Your users don't have to worry about an API change breaking stuff. You can ensure the dependencies are up-to-date and secure.

Of course, some people also realize that supporting system dependencies is a hassle. You don't have to be bothered with sudden API changes when you have full control over the version you're building against. You don't have to wait for upstreams to release new features, you can take them straight from the VCS. You don't have to communicate with upstreams at all; you can just fork everything and add whatever changes you need right now. And nowadays, you don't even have to do it yourself, you can just ask a chatbot to do it for you.

So here we are, with everyone rolling their software with bundled dependencies, sometimes supporting system libraries and sometimes not, sometimes working only with old versions of system libraries and sometimes outright requiring custom forks. And then a major #security vulnerability happens and suddenly everyone is engaged in patching their bundled dependency. Well, except for software packages that aren't really maintained right now and are stuck with a vulnerable bundled dependency.

And what happens next? Well, some people realize that their users are now running vulnerable dependencies, and start introducing another layer of workarounds. Because surely there's no way to sort the systemic problem out, we just need more hacks.

Yes, I'm talking about random packages making releases just for the sake of bumping their certifi dependency, to make sure people update it in the pathological world of #Python virtual environments. And I'm talking about #CPython adding hacks to workaround vulnerable certificate stores.