3 ms·
(author here) Yes, but you have to take into account the context. Every minute you spend "securing" your RELEASE NOTES is better spent securing the APPLICATIO
by chubot 9y ago
(author here) Yes, but you have to take into account the context. Every minute you spend "securing" your RELEASE
NOTES is better spent securing the APPLICATION.
A lot of people seem to be missing the point -- this is a quick solution that also correct (*). It's a middle ground.
Yes it has drawbacks, and I analyzed those extensively in the article. Engineering is about tradeoffs. Given infinite resources, yes you want to do the "right thing". But you don't have infinite resources.
- falsedan 9y agowhy can't I upvote this infinite times
- throwawayjava 9y ago> Every minute you spend "securing" your RELEASE NOTES is better spent securing the APPLICATION. I've never worked in a place where developer time is really that zero-sum. If your release notes are executable code running on your infrastructure, then their security does matter. I'm sure there's a team of developers at Avast who wish they had spent more time securing their "release notes".