Re: Lua [in]security and the distributors

[Jonas Thiem <jonasthiem@...>]

Well I can bundle it.

However, if every app dev does that, some are bound to forget to update
it in time (especially if it's an open-source project handled by a
single person) - might even happen to me.

I guess I'm gonna do it now, but it would be infinitely better if we
could work towards a scenario where distributors are easily aware of
security issues and then do timely patches, so we don't need to rely on
all the app devs to update Lua for themselves.


That is just my opinion though, which seems to differ with everyone
else's here. I guess there is no point for me to participate in this
mailing thread any further, I'm just going in circles by now.

I just hope you get what I'm after, and maybe one day you'll actually
think it is a decent idea. Up to that day I'll bundle a trustable Lua
myself.

Regards,
Jonas Thiem

On 08/29/2014 12:11 AM, Luiz Henrique de Figueiredo wrote:
>> Yes, but in practise all linux users would hate me for shipping Lua when
>> their system already has it
> 
> I don't think so.
> 
> See http://lua-users.org/lists/lua-l/2014-05/msg00381.html which is about
> updating Lua via shared libraries and why we don't think that's warranted.
> In summary, Lua is not a critical component in an OS: it is meant to be
> embedded, not update system-wide, which may break some apps.
>