Re: Please add warning to download page if tarball isn't patched up with all latest security fixes

[Dirk Laurie <dirk.laurie@...>]

2014-08-22 8:50 GMT+02:00 Thijs Schreijer <thijs@thijsschreijer.nl>:

> Document the release properly in that it might not be
> patched up to the latest, just makes it more clear.

There seems to be a misunderstanding here. Patches on the bugs
page are not "the latest", and the recommendation to Lua users
is not to apply the whole lot of them indiscriminately. They have
not been tested rigorously. They do not all originate from
PUC Rio. They are more like Wiki entries.

For example, suppose I am the package manager of Balaclava
Linux, and I am preparing a Lua package for the Android ARM
architecture. There is a patch available for a bug that has been
reported as affecting amd64 machines. Should I blindly apply
that patch? Of course not. If it ain't broke, don't fix it.