Re: Lua [in]security and the distributors

[David Heiko Kolf <david@...>]

Jonas Thiem wrote:
> Enrico, sorry I blamed the distributors (which includes you?) so
> publicly, it is just a bit sad to see how something published in April
> 2013 is still unfixed everywhere.

Well, to me the question would be whether this is entirely the
distributors problem. For security related bugs it might help to release
binary compatible new minor versions even of old Lua versions quickly
after a fix is found. Especially of Lua 5.1 as it is probably still the
most widely used version.

Though if a distribution continues to use Lua 5.2.2 instead of 5.2.3 (as
it sounds like in your original mail from 2014-08-21) then of course the
fix won't be in there and it should be obvious to everyone familiar with
program versions. (Released versions should never change).

Best regards,

David Kolf