Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.
  • earthworm@sh.itjust.worksEnglish
    14·
    1 day ago

    The careful reader may note that my title is not quite accurate. It’s not every dependency you add that’s a problem; it’s every dependency you update.

    Why not put that in the title, Mr. Hoyt?

      • corsicanguppy@lemmy.caEnglish
        1·
        1 day ago

        Every dependency you don’t update is a zero day waiting to happen. All software carries risk.

        In the same breath you’re advocating updating without checking, and saying why that’s an issue. You … realize that, right?

        You’re so close to realising the reason enterprise distros do backports.

        • renegadespork@lemmy.jelliefrontier.netEnglish
          2·
          22 hours ago

          you’re advocating updating without checking,

          Uh… no. That’s not what I said. I said there’s risk in both updating and not updating. You need to do the assessment to decide which one is best for the situation.