4 ms·

how is age a good factor for a good library?

• closeparen 6y ago
  Stale libraries are a risk factor for publicly disclosed vulnerabilities (likely more exploitable than the underlying OS, since library code is closer to user input). Also for diamond dependency conflicts when you try to bring in or upgrade a different library.
  • m_eiman 6y ago
    A better measure would be "(security) issues reported since the version you're using", I suppose.
    • DEADBEEFC0FFEE 6y ago
      Only if you think all the security issues have been found in all the libs. Lesser known libs can be riddled with vulns that nobody has found.
• unhammer 6y ago
  > The reported security vulnerabilities study shows that sys-tems with a low dependency freshness score are more than four times as likely to contain security issues in these depen-dencies. This confirmed the relationship between the security quality factor of a system and its dependency freshness rating, although no claims of causation could be made https://ericbouwers.github.io/papers/icse15.pdf#page=9&zoom=160,-67,385 https://ericbouwers.github.io/papers/icse15.pdf#page=9&zoom=...