uticus

WRT package vulns, I'm surprised there's not more technical theory out there. We have plenty of theory around algorithm design, but so far I haven't heard much about inspecting and improving control of dependencies in source - apart from conflict and version management.

Seems like instead of big-O notation, we could have a "reach index" - how far does the top-level code need to reach, to be effective? Top-level -> Userland lib 1 -> Userland lib 2 -> Kernel, would be a reach level "4" - not the simplest, but much simpler to inspect and securely build than reach level "20".

From the actual announcement:

> ...package adoption is currently disabled while we are handling the situation.

Sounds much more like the temporary pause, than the much less temporary-sounding "has been disabled" from the OP.

"Described as a first of its kind, the mission could be a glimpse of what’s to come for amphibious operations."

sometimes the wizards know best when to fear magic