3 ms·

Because you seem to think the choice is between grabbing the latest and greatest (“Hey look, no bugs found in yesterday’s release!”) and an old version with lot

Because you seem to think the choice is between grabbing the latest and greatest (“Hey look, no bugs found in yesterday’s release!”) and an old version with lots of bugs. The alternative is patched versions, which your comment makes no mention of. Perhaps patches were what you meant by “new versions”, but then that doesn’t fit in the context of the conversation.

jacques_chester 8y ago
> Perhaps patches were what you meant by “new versions” I thought that was obvious from context. I guess not. I'm used to the idea that latest versions are safer, mostly because I have worked in and around systems intended to create that assurance. Where I work we track every upstream CVE patch that affects us until it has been released to customers. Large parts of this process are automated. On a good day the patch lands upstream and a fresh version of our own software rolls off the production line a few hours, fully baked and fully tested. My sensitivity to allowing versions to fall behind comes from knowing that a) it doesn't have to happen and b) that software that fell behind cannot reduce its bug or vulnerability count without being upgraded. New versions absolutely introduce new bugs, but on the balance of risks, a known vulnerability is more likely to exploited than an unknown one.
- weberc2 8y ago
  > I thought that was obvious from context. I guess not. I was/am confused because the context is max selection vs MVS. You appear to be arguing against MVS, so I assumed you were taking the max selection position, but max selection is incompatible with patched versions while MVS is not. Based on your most recent comment, it appears you're not arguing for max selection nor against MVS, but rather you're arguing against pinning to an unpatched version (I don't think anyone in this thread is advocating for this, hence my confusion). It's still unclear to me if you're arguing for max selection or MVS with latest patch version. Your third paragraph seems to set up a false dichotomy between max selection and unpatched old versions while your second paragraph seems to favor MVS/latest-patch-version. This whole conversation seems to be unnecessarily complex with its digressions and false dichotomies. I think everyone can agree on the following: 1. Pinning to unpatched old versions is the worst of all (no one is advocating for this afaict) 2. Max selection is susceptible to new vulns (the rate of vuln discovery is greater in new versions than in old versions) 3. MVS/latest-patch-version (go get -u patch) is the safest of the three

jacques_chester 8y ago

> Perhaps patches were what you meant by “new versions” I thought that was obvious from context. I guess not. I'm used to the idea that latest versions are safer, mostly because I have worked in and around systems intended to create that assurance. Where I work we track every upstream CVE patch that affects us until it has been released to customers. Large parts of this process are automated. On a good day the patch lands upstream and a fresh version of our own software rolls off the production line a few hours, fully baked and fully tested. My sensitivity to allowing versions to fall behind comes from knowing that a) it doesn't have to happen and b) that software that fell behind cannot reduce its bug or vulnerability count without being upgraded. New versions absolutely introduce new bugs, but on the balance of risks, a known vulnerability is more likely to exploited than an unknown one.

weberc2 8y ago
> I thought that was obvious from context. I guess not. I was/am confused because the context is max selection vs MVS. You appear to be arguing against MVS, so I assumed you were taking the max selection position, but max selection is incompatible with patched versions while MVS is not. Based on your most recent comment, it appears you're not arguing for max selection nor against MVS, but rather you're arguing against pinning to an unpatched version (I don't think anyone in this thread is advocating for this, hence my confusion). It's still unclear to me if you're arguing for max selection or MVS with latest patch version. Your third paragraph seems to set up a false dichotomy between max selection and unpatched old versions while your second paragraph seems to favor MVS/latest-patch-version. This whole conversation seems to be unnecessarily complex with its digressions and false dichotomies. I think everyone can agree on the following: 1. Pinning to unpatched old versions is the worst of all (no one is advocating for this afaict) 2. Max selection is susceptible to new vulns (the rate of vuln discovery is greater in new versions than in old versions) 3. MVS/latest-patch-version (go get -u patch) is the safest of the three