See how pkgsrc compares to other vendors in security performance
Date: Fri, 16 May 2025 21:52:14 -0500 From: Jacob Bachmeyer <jcb62281 () gmail com>
On 5/16/25 13:07, Eli Schwartz wrote: On 5/16/25 12:31 PM, Taylor R Campbell wrote: [...] (a) the same pkgsrc packages are available on, e.g., NetBSD 9.x (which is not EOL); and
(b) pkgsrc is used on platforms other than NetBSD, including macOS, SmartOS, and various Linux distributions (e.g., for unprivileged use on HPC clusters where it is more flexible and up-to-date than the Linux distribution's package manager).
That is why it would be more accurate for the report to say pkgsrc-2025Q1', not NetBSD 10.1'. I strongly dispute this. It should instead list both, as both are affected. Would "systems using pkgsrc-2025Q1, notably including NetBSD 9.x and NetBSD 10.1" have been a fair way of describing that set? Sure, that's fine, or just ...notably including NetBSD' instead of specifying versions since NetBSD and pkgsrc versions advance independently.
If I gave anyone the impression that I'm trying to conceal its impact on NetBSD users, as Eli has insinuated with fabricated quotes, I apologize (for that and for all the off-topic noise this minor point has generated) -- we did not escape this, and we are working to address it for all pkgsrc users on NetBSD or otherwise.
This will be my last message on the subject in this thread; I'm sure everyone is tired of hearing about it now.
On 5/16/25 13:07, Eli Schwartz wrote: On 5/16/25 12:31 PM, Taylor R Campbell wrote: [...] (a) the same pkgsrc packages are available on, e.g., NetBSD 9.x (which is not EOL); and
(b) pkgsrc is used on platforms other than NetBSD, including macOS, SmartOS, and various Linux distributions (e.g., for unprivileged use on HPC clusters where it is more flexible and up-to-date than the Linux distribution's package manager).
That is why it would be more accurate for the report to say pkgsrc-2025Q1', not NetBSD 10.1'. I strongly dispute this. It should instead list both, as both are affected.
(Again, b is the same distinction as "Gentoo, but also portage-20250508, are both affected".)
-- Jacob