RE: Please add warning to download page if tarball isn't patched up with all latest security fixes

[Thijs Schreijer <thijs@...>]

> -----Original Message-----
> From: lua-l-bounces@lists.lua.org [mailto:lua-l-bounces@lists.lua.org] On
> Behalf Of Dirk Laurie
> Sent: donderdag 21 augustus 2014 20:58
> To: Lua mailing list
> Subject: Re: Please add warning to download page if tarball isn't patched up
> with all latest security fixes
> 
> 2014-08-21 20:36 GMT+02:00 Jonas Thiem <jonasthiem@googlemail.com>:
> > I would recommend being a bit more explicit, like:
> >
> > 1. "Patches to reported bugs - not necessarily incorporated into the
> > latest release yet - are on the [Bugs page]."
> >
> > 2. or "Patches to reported bugs are on the [Bugs page]. Please note
> > the latest release doesn't necessarily incorporate all of them yet."
> >
> > 3. or an even more obvious "Patches to reported bugs are on the [Bugs
> > page]. Please note the latest release doesn't necessarily incorporate
> > all of them yet: you might need to patch them in manually if the
> > bugfixes are important to you."
> 
> The Lua download page is intended to help people who do not
> know much, not to remind people who should know better what
> things they must not forget. The kind of wishy-washy uncertainty
> in these proposals will just confuse, even scare, the person who
> is downloading Lua for the first time, to quite probably a Windows
> machine, for what is likely to the first C program she ever compiles.
> 
> Show me one download page of a well-tested reliable product
> that contains the sort of phrasing you suggest. Just one.

Good code without documentation is hard to use. Same applies here. Document the release properly in that it might not be patched up to the latest, just makes it more clear. Doesn't harm anybody.

+1 for Jonas's proposal

Sorry Dirk, imo you're making a silly argument here.

Thijs