Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.
  • corsicanguppy@lemmy.caEnglish
    1·
    1 day ago

    Every dependency you don’t update is a zero day waiting to happen. All software carries risk.

    In the same breath you’re advocating updating without checking, and saying why that’s an issue. You … realize that, right?

    You’re so close to realising the reason enterprise distros do backports.

    • renegadespork@lemmy.jelliefrontier.netEnglish
      2·
      22 hours ago

      you’re advocating updating without checking,

      Uh… no. That’s not what I said. I said there’s risk in both updating and not updating. You need to do the assessment to decide which one is best for the situation.