This is the most nuts Debian Security Advisory I've ever seen

who even pays developers to work on Debian

From: grep at 2021-04-07 17:43:55
who even pays developers to work on Debian

Depends. I am not paid now. I was a consultant at a previous position and part of what I did was help them integrate with the parts I work on - they got my expertise for the things on their side and Debian got good bug reports and fixes on their side.

There was a previous Debian Project Leader that put together funding to pay the release engineers to help accelerate a release and that caused a Debian Developer revolt, so the history of it is not great….

Wait they revolted against getting paid

Only a few developers got paid - many of the rest were angry about that.

LWN covered it at the time: https://lwn.net/Articles/201488/

thanks google

I assume that’s why they make it auto-upgrade, and I’m sympathetic because they have to deal with malicious, attacker controlled network input, but so does Firefox and it seems to have fewer CVEs across the same amount of time.