Distro package maintainers are different than software dev maintainers.
They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)
Cause like I can write a ton of guix configs that’ll probably run until the next ice age, but that does nothing about the dev who’s software I packaged, that now decided they’re personally god and need to spread christ as fast as possible.
(Also off topic but that’s the power and curse of nixos-like distros, its too easy to package so odds are the shit ain’t updated, and suddenly there’s 1000 Firefox packages in nixpkgs)
They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)
Some people do an astounding amount of work.
And then there are many, many, which help a little.
Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.
Distro package maintainers are different than software dev maintainers.
They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)
Cause like I can write a ton of guix configs that’ll probably run until the next ice age, but that does nothing about the dev who’s software I packaged, that now decided they’re personally god and need to spread christ as fast as possible.
(Also off topic but that’s the power and curse of nixos-like distros, its too easy to package so odds are the shit ain’t updated, and suddenly there’s 1000 Firefox packages in nixpkgs)
Some people do an astounding amount of work.
And then there are many, many, which help a little.
Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.