A couple of replies in, they say "In other words, the idea that you can pre-declare a lifetime is fantasy." The thing is, it's really not. You say "we'll support version <foo>", and that means that you release security fixes for <foo> that don't change anything else. It's then easy for maintainers to decide whether the need for the security fix affects them or not.
The alternative is discrete versions where any number of things can change between versions, but you have to accept everything in order to receive security fixes. In some instances, those are inevitably going to break backwards-compatibility for at least someone despite all best efforts, and this may even kick off regulatory compliance procedures.
Either way, distros are going to continue to do the "we'll support version <foo>" thing, so this is basically offloading the need to carve out security patches to them. In some cases, they might even have to write the security patches themselves. And this is supposed to make our systems more secure?
I can't wait for LibreSSL to be usable, if this is how the OpenSSL developers think.
The alternative is discrete versions where any number of things can change between versions, but you have to accept everything in order to receive security fixes. In some instances, those are inevitably going to break backwards-compatibility for at least someone despite all best efforts, and this may even kick off regulatory compliance procedures.
Either way, distros are going to continue to do the "we'll support version <foo>" thing, so this is basically offloading the need to carve out security patches to them. In some cases, they might even have to write the security patches themselves. And this is supposed to make our systems more secure?
I can't wait for LibreSSL to be usable, if this is how the OpenSSL developers think.