The modern packager’s security nightmare
Over the last several weeks I was working on an essay about this exact problem, including the connection between static linking and bundling. This one is so well done that I probably won&#x27;t even publish it.<p>But I&#x27;ll add this, for people who may not immediately see why this is important. I think that the real danger these new technologies represent is not inherently bad technology, but the possibility of ecosystem damage. The distribution &#x2F; maintainer &#x2F; package manager approach has proven to be an extremely reliable way to get trustworthy software. Many of us love it and want to see it stick around. And it&#x27;s been possible because &quot;upstream&quot; developers in the open source ecosystem have been willing (or forced) to work with distributions to include their software. But this seems to be changing. A highlight from my essay:<p>&#x27;Many software projects are not good citizens in the open source ecosystem. They are working with a model of development and distribution that does not mesh well with how open source software is predominantly produced. ... These [new] languages are now developing <i>their own</i> ecosystems, with their own expectations for how software should be created and distributed, how dependencies should be handled, and what a &quot;good piece of software&quot; looks like. Regardless, an increasing amount of software is being built in these ecosystems, <i>including</i> open source software.<p>There might come a day in which open source is fractured. Two different communities create two very different kinds of software, which run on the same systems, but are created and distributed in very different ways. I begin to worry that the community I care about might not survive. Even if my ecosystem continues on its way, I don&#x27;t want this split to take place. I think being part of the open source ecosystem is good for software, and I think having all the software you could want available within that ecosystem is good for users. If anything, this essay is a call to those who agree to be more careful about the software they create. Make sure it&#x27;s something that Debian maintainers could be proud to ship. If you&#x27;re working on a Rust program, for example, ask questions like &quot;how can I make this program as easy for maintainers to distribute as possible?&quot; If you have the ability to work on projects like Rust or Go, do what you can to give their applications the ability to easily split dependencies and support system provided libraries. Let&#x27;s try to make sure the software ecosystem we love is around for the next generation.&#x27;<p>I&#x27;d also strongly recommend the essay &quot;Maintainers Matter&quot; for another take on why this is so important. <a href="http:&#x2F;&#x2F;kmkeen.com&#x2F;maintainers-matter&#x2F;" rel="nofollow">http:&#x2F;&#x2F;kmkeen.com&#x2F;maintainers-matter&#x2F;</a> Or read about Debian&#x27;s recent problems with vendoring: <a href="https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;842319&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;842319&#x2F;</a>