> they will never update those libraries, or aren't willing/able to > create an AppImage build system which does update libraries, then your > point is valid and OpenSCAD should always be beholden to distro > libraries. If the opposite is true, then this point does not apply to > OpenSCAD and AppImage is fine to use here. Yes you can do it right with something like Jenkins and cron jobs auto-rebuilding and re-posting the image when a trusted source of a new version of the various pieces appears. > As Alan said, this happens a lot in container land too. I also shudder > to think how many containers are out there still vulnerable to serious > vulnerabilities. Containers make this problem much more opaque than > AppImage too imo. The better container folk have I think got a handle on it however. Firstly they use lightweight virtual machines for security, secondly they use docker layers so that the only pieces that would be in say an OpenSCAD container would probably be OpenSCAD and CGAL (and maybe a couple of other other more problematic C++ libraries). When you run it then it will get unioned with an up to date ubuntu and run. The risk for OpenSCAD is also lower than many things because a lot of the formats it handles through libraries are output only which reduces the attack surface. Realistically you've got to aim at inputs habitually used from the internet, and for the most part that means the OpenSCAD parser and maybe the importers. > Practically, OpenSCAD is probably safe from those issues... not because > it won't be vulnerable, but because it simply won't be a big enough > target for the bad guys to shoot at. That's unfortunately a rather 1990s viewpoint. OpenSCAD is an interesting target because people habitually use it to process files directly from the internet, a successful attack would be likely to obtain things like a Shapeways account and lots of design files, and because it has folks using it with addresses from 'interesting' companies whose stuff is worth stealing. The 'bad guys' work on economic models of risk not volume. One US power company account is worth a lot more to the right people than 10,000 random facebook users. Alan