5 ms·
There's a difference between an old version where everybody know about the vulnerabilities because they were patched, and a new version where pretty much nobody
by Jyaif 8y ago
There's a difference between an old version where everybody know about the vulnerabilities because they were patched, and a new version where pretty much nobody knows any vulnerability (otherwise they would have been patched).
- jessaustin 8y agoEveryone who knows about the old vulns can avoid them easily with minimum version, just by setting their dependency versions properly. The new unknown vulns about which no one knows are avoided automatically. Re-reading the thread, maybe this is what you meant? I'm not sure, possibly because this is also what 'kjksf meant.
- jacques_chester 8y agoThe arguments are directed past each other. Minimal selection breaks down when you ignore it and thereby allow known bugs to pile up. Maximal selection breaks down when you ignore it and thereby allow unknown, untracked dependencies to pile up. The answer for both is that version updating should trigger CI activity and then be automatically applied when tested. Dependency tools should be as strictly dumb as possible. This gap exists because dependency management tools blossomed and matured in a manual developer-at-a-keyboard context before the kind of automation that makes their clever bits less relevant or necessary.
- weberc2 8y agoVulnerability scanning favors old versions. If you have this, you’re probably in a (considerably?) safer place with MVS than max selection.
- jacques_chester 8y ago> Vulnerability scanning favors old versions. I don't follow. Could you elaborate?
- weberc2 8y agoVuln scanning depends on vulns having been discovered. These vulns are more likely to be discovered in old versions than new versions.
- jacques_chester 8y agoI agree. But I think we're disagreeing on what policy follows from that.