4 ms·
Agree, but having to make these judgement calls at all is a mistake. We need to get to 'just fix it'.
by beardedwizard 6y ago
Agree, but having to make these judgement calls at all is a mistake. We need to get to 'just fix it'.
- TheDong 6y agoI don't quite get what you mean. There's finite time and developer effort. You always have to make judgement calls about what to prioritize over what, you can't "just fix it" for literally everything unless you're in a very fortunate position of working in a codebase with minimal tech debt, a mature scope, and sufficient developer-hours. If you're saying that the CVEs that amount to "update dependency X" or whatever should be "just automatically fixed" rather than have to be prioritized, I agree that should be true for a subset of em... But not every dependency update or CVE resolution is trivial, and even the supposedly trivial ones may still require a certain amount of testing or refactoring.
- whydoyoucare 6y agoIf the codebase is sufficiently complex, irrespective how mature and tech-debt-free, certain dependency upgrades are simply non-trivial (this includes the testing effort as well as the actual upgrade effort). Like they say "there are no small changes in a big system". So resolving certain CVEs' is simply a delicate balance to be had between the actual damage potential and the amount of effort.