4 ms·
#2 isn't surprising. A ton of shops only patch on a quarterly basis, and even then they only consistently patch the OS. Only when there is a vendor (like my emp
by cpitman 9y ago
#2 isn't surprising. A ton of shops only patch on a quarterly basis, and even then they only consistently patch the OS. Only when there is a vendor (like my employer, Red Hat) sending out notices that there is a critical vulnerability do people move any faster.
Which is twice as bad for application dependencies. These don't even have quarterly patch cycles. Dependencies may be updated when a new release is deployed, which may be a couple times a year or never. One of my favorite questions for clients is "who is responsible for patching applications with no development team anymore?"
This is an underappreciated benefit of CICD. An automated process lets you get a central group to take ownership of third party libraries and their security, and then let them trigger all applications to rebuild and release. Especially with containers, this is essential.
- gsylvie 9y agoTHIS: > "who is responsible for patching applications with no development team anymore?" Struts 2.2.3 (oldest vulnerable version) was released on May 7, 2011. Personally I find it easy to imagine an app depending on that, going into prod, and just chugging away, forgotten for 6 years on some obscure corner of an enterprise's public (or internal) web assets.
- greedo 9y agoGetting business lines to sign off and invest the resources to update applications can be a huge challenge. Shiny new applications get all the attention, but maintaining and updating legacy applications is not prioritized.
- speedplane 9y agoI personally have no idea how large companies manage this. Every time I perform a full Docker update on all of the libraries and applications my app is running on, something breaks. Sure, tests catch it, but it takes a developer and time to figure out how to fix it. No idea how huge non-developer organizations handle this.