> These dependencies are predictably wrong in any number of cases, because they've never been really used before.
Then fix them. Isn't that considered good software engineering in all other contexts? At least where I work, you're not allowed to merge until all the unit tests are green, and if someone writes a new unit test that reveals your component was broken all along, you fix it.
The comparison to security is not valid at all. I was on the side of pragmatism and the letter-writers, and against the Guardian and the purists, on the recent WhatsApp fracas, which you'd think would pit me against systemd here, but the analogy is flawed. We have to be pragmatic about security because it involves the choices of uninformed and uninterested users, and we have to maximize their security given that they frequently make bad choices and we have little hope of making that better. systemd is exposing problems that were created by developers and can be fixed by developers.