4 ms·

Good read, I like that he expanded on the assumptions we make when we include a dependency. However, I think his treatment of dependency upgrades is a bit confu

Good read, I like that he expanded on the assumptions we make when we include a dependency. However, I think his treatment of dependency upgrades is a bit confused. Of course Equifax should have upgraded their struts dependency, but that is not the result of relying on software reuse, as security vulnerabilities are found in all code. If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored. So to me the point is that important upgrades, whether proprietary or FOSS, should be made as backwardly compatible as possible. Fortunately, they usually are. A related issue that wasn't mentioned in the article is the problem of forced upgrades. Dependencies can arbitrarily introduce incompatibilities that don't align with your own priorities, so that you end up spending a lot of time keeping current with package releases that your users really don't care about. Publicly facing services with a broad attack surface should choose their dependencies carefully, as they'll be forced to upgrade often. Services behind a secure firewall are less urgent.

zaphar 7y ago
I think you missed his point on the Equifax story. I think he was trying to illustrate that their reliance on the Struts dependency come with a responsibility of both knowing where that dependency was being used. As well as monitoring that usage to ensure that you aren't left vulnerable by that usage. It's entirely orthogonal the responsibility of publishers of the dependency which you address in your comment. Both are important. But Russ's audience wasn't publishers. He was talking to the consumers and what they need to understand when they take on a dependency.
weberc2 7y ago
> If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored. I believe you're just making the inverse assumption from Cox. He seems to assume a monorepo-esque setup where everyone depends on HEAD, and you seem to assume a microrepo-esque setup where everyone declares their own dependency revisions.

zaphar 7y ago

I think you missed his point on the Equifax story. I think he was trying to illustrate that their reliance on the Struts dependency come with a responsibility of both knowing where that dependency was being used. As well as monitoring that usage to ensure that you aren't left vulnerable by that usage. It's entirely orthogonal the responsibility of publishers of the dependency which you address in your comment. Both are important. But Russ's audience wasn't publishers. He was talking to the consumers and what they need to understand when they take on a dependency.

weberc2 7y ago

> If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored. I believe you're just making the inverse assumption from Cox. He seems to assume a monorepo-esque setup where everyone depends on HEAD, and you seem to assume a microrepo-esque setup where everyone declares their own dependency revisions.