Notes from building heretix

Why a version number can't tell you whether you're vulnerable

Backports, source packages and release streams: what a vulnerability scanner has to know about a Linux distribution.