Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 25 Jan 2017 16:48:04 -0500
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Windows ports of Linux software bundling outdated
 libraries (Gajim / PyCurl)

> tl:dr; use Fedora or OpenSuse and their mingw-w64* packages to
> cross-compile and package from Linux; if you use Windows or OS X or
> anything else, use one of these in a VM.

Maven and Git are noteworthy here.

Maven was infamous for outdated packages. Confer, "The Vulnerability
Dataset of a Large Software Ecosystem",
http://bkarak.wizhut.com/www/pubs/pdfs/badgers2014.pdf.

Git took it to the next level and made it distributed. Instead of one
outdated repo like Maven, we now have hundreds or thousands of
outdated followers who don't pulll from master.

Jeff

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.