Poettering: Revisiting how we put together Linux systems

Security fixes must happen, there is no way around that. However, we need to make sure that we allow them to be done by people who have the expertise and focus on fixing them. Hence: programs like firefox or google earth that you download from their respective website usually come with a ton of bundled libraries, in the versions mozilla or google has tested their stuff with. Now these vendors are actually not that interested in those libraries, they are primarily just interested in their own app code. So, the runtime concept is about attempting to put together a fixed set of libraries in a fixed set of versions that is basically immutable (modulo the minimal changes necessary to do CVE fixes), maintained by people who actually care about the library code. This way, you give the app vendors what they want (which is a fixed set of libraries, in specific versions that they can test stuff with and where they know that it is exactly this version the stuff will ultimately run on) but at the same time you retain the ability to minimally update the libraries for CVEs, because the runtimes are still maintained by the runtime vendor, and not by a mostly-desinterested app vendor.