Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.
    • corsicanguppy@lemmy.caEnglish
      1·
      22 hours ago

      Every dependency you don’t update is a zero day waiting to happen. All software carries risk.

      In the same breath you’re advocating updating without checking, and saying why that’s an issue. You … realize that, right?

      You’re so close to realising the reason enterprise distros do backports.

      • renegadespork@lemmy.jelliefrontier.netEnglish
        2·
        20 hours ago

        you’re advocating updating without checking,

        Uh… no. That’s not what I said. I said there’s risk in both updating and not updating. You need to do the assessment to decide which one is best for the situation.