On 11/12/26 6:19 PM, Max Nikulin wrote: > I am in doubts if it is really so, that is why I raised the question > again. I suspect, Andrew oversimplified writing that response. Of > course, installer uses packages from the image and apt is not used on > that step. However to get security updates without apt it is necessary > effectively to reimplement apt. From my point of view, it unnecessary > burden since it is much easier to just use apt. > > I do not mind that new system is not vulnerable as soon as security > updates are installed. So the window for attacks is narrow, but it exists. In that case such a bug would no longer be addressed by a new point release (emergency or otherwise) as it'd exist outside of both apt and ca-certificates.
- monodev
