Changelog.txt in Slackware - where's the AL alternative?

Question

Hello fellow Archers,
In the few weeks I'm using AL now, there is one thing I miss and would like compared to Slackware. Slackware, had this changelog.txt on the website and the ftp where you could find the changes and what the changes were. These changes were mainly about security fixes, updates, addition or removal of software.
Using AL, there is no way of knowing (or I did not discover a way) what a next release/update will bring and what was the reason for it.  Even when you decide to download the packages and not install them right away it might be a good idea to read the changelog to see what is important and urgent (major security fixes) or less important. That way you could choose to install software or keep using the version you run without problems. I know there are wiki entries containing information about for example KDE, but these do not exist for every single package.
There are some ways of doing this:
- a dedicated mailinglist with package announcements and changelogs
- a file included in the package
- an announcement in a seperate forum
- some centralized solution like Slackware has (one maintainer)
- on the website seperate indication for update type (Sec/Norm/??)
- some of the above
- all of the above
Did I miss something or does something like this does not exist for AL ? And if not, how do you think about this changelog idea ?
Cheers.

Answer 1

puntmuts wrote:Too bad that AL does not have anything of a changelog or security update notification. Almost any distribution has a mailinglist / webpage with security updates and it makes it easier for users to update their systems and keep them safe.
AL just has a diferent philosophy. With no real "release schedule", and using rolling releases, it is hard to track a changelog. Security update notifications would be a good thing though. Right now there is just a lowly forum topic, and several of the devs never visit the forum, so likely it is only useful for users discussing issues they find. A few security notices come up on the main site, but I agree that doesn't really "cut" it.
It would be nice to have a security mailing list, where the devs put out notices and such. Then it would be easy to just look at the mailing list archive, and see what is going on..or to subscribe to the list..etc etc.
Maybe I should use something else for server purposes, I do not have the feeling security is an serious issue at AL.
I think the last statement you made is the most important. It is really about how you FEEL. I feel relatively fine with my server setups. I have them locked down fairly well, and since they don't really do alot right now, I am not overly concerned with their current status. Arch makes a great devel box too. So, for me, it is ok.
If I needed 3 or 4 9's worth of uptime, and had lots of important data running around on my servers, I would likely go for something like RH or SuSE. Something that has LOTS of upstream testing. Maybe debain, or one of the BSD's.
If you do not feel comfortable with it, then by all means, use something that you DO feel comfortable with. No sense laying awake at night worrying about your data.
I personally am starting to view Arch as more of a development environment (which is great because things are so up to date), and as a decent desktop (again, good because of up to date, and for me desktop==dev box). It is also damn fun for geeking out on. I cant tell you how many obscure things I have tried to do on my arch boxen..lots of good geeking around (like. Can I build a pkgbuild for this? and..can I get this to work? etc.)
I am not sure it would be my first choice in a critical production environment, though.
*shrug*
But then again, who knows. It would depend on the situation..