![](https://feddit.uk/pictrs/image/5d293428-9697-45e8-9cc4-f7b2b9c16462.png)
![](https://fry.gs/pictrs/image/c6832070-8625-4688-b9e5-5d519541e092.png)
How do Linux distro’s deal with this? I feel like however that’s done, I’d like node packages to work in a similar way - “package distro’s”. You could have rolling-release, long-term service w/security patches, an application and verification process for being included in a distro, etc.
It wouldn’t eliminate all problems, of course, but could help with several methods of attack, and also help focus communities and reduce duplication of effort.
Red Hat saying that argument in-particular shows they’ve pivoted their philosophy significantly, it’s a seemingly subtle change but is huge - presumably due to the IBM acquisition, but maybe due to the pressures in the market right now.
It’s the classic argument against FOSS, which Red Hat themselves have argued against for decades and as an organisation proved that you can build a viable business on the back of FOSS whilst also contributing to it, and that there was indirect value in having others use your work. Only time will tell, but the stage is set for Red Hat to cultivate a different relationship with FOSS and move more into proprietary code.