The modern packager’s security nightmare
I feel like this confuses a lot of things by assuming an extremely sophisticated end user.  Sure, if you&#x27;re a double-threat dev&#x2F;sysadmin using linux, then when some vulnerability gets discovered in some dynamically linked library on your system, you have the capacity to (a) receive information about that fact, and (b) update it.<p>But now suppose you&#x27;re an ordinary person.  You use software.  Maybe you even have a windows machine.[1]  Which is more likely to actually get a security update to you?<p>(a) You have to update a single piece of software, which you know you&#x27;ve installed, though a recognized distributional channel like an app store or something, and all its dependencies come with it.<p>(b) You have to either learn what a DLL is and learn how to update it and then hope that nothing you rely on breaks in some mysterious way because of some dependency on a dependency on a dependency on a dependency.  Or you have to accept a whole operating system update, assuming that the operating system comes with a DLL update---and hence accepting all of the other crap that comes with operating system updates from Microsoft (and Apple), such as bugginess from complex updates, incompatibilities between new versions of operating systems and software (or hardware) that you rely on, new obnoxious security rules that you might not agree to (looking at you, Cupertino), and massive disruptions to your ability to actually use your computer to do your work.<p>No thanks.<p>[1] Maybe this article is specifically targeted against the linux ecosystem?  If so, perhaps this issue is ameliorated somewhat, but it still seems to put a fairly substantial burden on end users, that seems to be inconsistent with actually letting non-experts use linux OSes.