3 ms·

* Developer who missed CVE fixed in his dependencies (if was not clear) Em, like all other packages?

• earthboundkid 6y ago
  Say we have program X with dependency Y. X+Y is either dynamic or static. X can either have responsive maintainers or unresponsive maintainers. Y can either change to fix a bug or change to add a bug. (With Heartbleed, I remember our server was fine because we were on some ancient version of OpenSSL.) Here are the scenarios: - dynamic responsive remove bug: Positive/neutral. Team X would have done it anyway. - dynamic unresponsive remove bug: Positive. - dynamic responsive add bug: Negative. Team X will see the bug but only be able to passively warn users not to use Y version whatever. - dynamic unresponsive add bug: Negative. Users will be impacted and have to get Y to fix the error. - static responsive remove bug: Positive/neutral: Team X will incorporate the change from Y, although possibly somewhat slower (but safer). - static unresponsive remove bug: Negative. Users will have to fork X or goad them into incorportating the fix. - static responsive add bug: Positive. Users will not get the bad version of Y. - static unresponsive add bug: Positive. Users will not get the bad version of Y. Overall, dynamic is positive 1, neutral 1, negative 2, and static is positive 2, neutral 1, negative 1. Unless you can rule out Y adding bugs, static makes more sense. Dynamic is best if "unresponsive remove bug" is likely, but if X is unresponsive, maybe you should just leave X anyway.
  • sergeykish 6y ago
    Sorry, this is offtopic. You have asked how is it possible - I've answered. Dynamic vs static discussed elsewhere in the thread, no silver bullet. I prefer to optimize against unresponsive author [0]. Chose your own distro [0] https://news.ycombinator.com/item?id=23458020 https://news.ycombinator.com/item?id=23458020