Re: Please add warning to download page if tarball isn't patched up with all latest security fixes

[Jonas Thiem <jonasthiem@...>]

I would recommend being a bit more explicit, like:

1. "Patches to reported bugs - not necessarily incorporated into the
latest release yet - are on the [Bugs page]."

2. or "Patches to reported bugs are on the [Bugs page]. Please note
the latest release doesn't necessarily incorporate all of them yet."

3. or an even more obvious "Patches to reported bugs are on the [Bugs
page]. Please note the latest release doesn't necessarily incorporate
all of them yet: you might need to patch them in manually if the
bugfixes are important to you."

Also yes, I don't want to defend the Fedora maintainers any further.
But I do think being a bit more obvious on the release and patching
practises could be helpful. (on the download page)

On Thu, Aug 21, 2014 at 6:31 PM, Dirk Laurie <dirk.laurie@gmail.com> wrote:
> 2014-08-21 17:13 GMT+02:00 Jonas Thiem <jonasthiem@googlemail.com>:
>> You are free to skip past it when downloading your lua tarball I
>> guess(?). I am not sure what to respond to this. Leaving out security
>> warnings because they are "too lengthy to read".. really?
>
> My point is that the sort of person that will do what you said the
> Fedora maintainer did [1], is perfectly likely not to bother reading the
> download page properly. In fact, I can argue that he already
> demonstrated that [2].
>
> But if the addition is not phrased as a warning to twits, merely as
> useful information for sensible people, I support the idea. Something
> like this:
>
> "The current version is [Lua 5.2] and its current release is [Lua 5.2.3].
> Patches to reported bugs are on the [Bugs page]."
>
> [1] Re-downloaded the same file! Assumed it would have changed
> despite having the same name! Did not notice, or if so, did not find
> it significant, that the length was the same!
>
> [2] The "patches" link is at the top of the downloads page for all to see.
>
>>
>> On Thu, Aug 21, 2014 at 5:01 PM, Dirk Laurie <dirk.laurie@gmail.com> wrote:
>>> 2014-08-21 16:36 GMT+02:00 Jonas Thiem <jonasthiem@googlemail.com>:
>>>
>>>> A note doesn't need much time to write.
>>>
>>> True, but it may take an eternity to read.
>>>
>>
>