On Mon, Feb 09, 2026 at 10:09:33AM +0300, Dmitry E. Oboukhov wrote:
Marc Haber писал(а) 2026-02-08 17:17:
I use bottles to run business applications for
Windows on Debian, at least a bit containered away and also isolated
from each other.
And it is not always easy to correctly judged whether
a missing security fix in a library will render an
application vulnerable without having intimate knowledge
on said app. With unvendored dependencies, we shrug it
away and just fix the library.
I see a contradiction here. Currently bottles is not in
Debian, meaning you're using flatpak (bottles is not
distributed otherwise). So currently embedding suits
you, but you would like it not to be in Debian. Why?
First, having quickly moving targets is usually not a good idea to have
in Debian. Second, bottles is just an example of software that has a
truckload of dependencies vendored in. We're talking about the generic
case here.
Further, Bottles simply downloads zip files with
libraries to your disk. How can the presence or
absence of embedding affect security? The security
of code running under wine, for which bottles is
just a delivery mechanism.
That is just not how Debian works.
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
