4 ms·

OK, let me be the one to say it: majority of tools don't need any updates if they already work as designed. You will say "what about security" but majority of

OK, let me be the one to say it: majority of tools don't need any updates if they already work as designed. You will say "what about security" but majority of apps don't need world level security, or any security at all. In large coorps for which I work exclusively big number of systems are older then decade without any source code change during that time and it is obviously good enough. I am just replacing the government e-banking system that worked 5 years without ANY change (source code seems to be lost). They are replacing it because it has bugs, not because it uses outdated dependencies (and we are talking here about state level service). I implemented babysitting side service that fixes the problems the original one makes as it detects them while we redo the entire stuff and we didn't hear any complaint after that. People obsessing over security and purity should learn to let it go and get down to Earth - if you don't have a problem, there is no need for fix. We have tones of old inventions people still use unchanged today. Door locks come first to my mind. Boosting up internal security often reminds me of keeping all house rooms locked with the best lock ever, and nobody does that (if you do, your house is exception and has some special use). Outdated deps are usually a problem in my experience when you need to redeploy some old work manually. That is one reason fat binaries are great. And this is also the major reason that using cloud services is a bad thing - you can't just let it be for as much time as you want. Vendor will change API and you must adapt or GTFO. I have currently at least 5 services that work in government unattended around decade and are critical.

gypsyharlot 6y ago
"If you don't have a problem, there is no need to fix it" You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here. First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No one is going to change your desktop wallpaper to say "You have been hacked", like in the movies... Which leads me to the second point. What valuables does your organization have? Do you have recipes for a special kind of glue that your researchers spent a few million dollars inventing? Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? And what about the customers that buy your product? Do they care if all your communication with them, and any issues concerning this product that should only be known internally is widespread?
- emilfihlman 6y ago
  >You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here No it's you who is making assumptions and operating on "it must be this way" sense. Simply because a project has not had changes in a few years (or even many years) doesn't make the project insecure or bad. Can there be bugs or security issues? Or course, any software can have those, but merely change rate as you see on the project download page has no bearing on that.
- majkinetor 6y ago
  > You obviously don't have much experience with security and you make a lot of assumptions here. You obviously work in security and want to sell me bs. > First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No, you assume a lot about me while knowing 0. The bigger problem here is that you assume that people in corp care that there are hidden agents taking some data out. Let me open your eyes: they usually don't and ESPECIALLY if its not visible. If you replace their main site front page they will care. > What valuables does your organization have? Dude... go read my post again. > Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company. WHEN they care, I do it. Mine is to inform. Theirs to decide. Guess what: they always decide against it, naturally, as it costs more otherwise. Security is a feature. It costs money. It can be theoretically done forever and take infinite amount of money. In last decade I had just 1 stakeholder requesting "unbreakable system" and we did the best we could. Your main mistake seems to be to extrapolate your context to entire world. Context is everything.
  - gypsyharlot 6y ago
    "> Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company." Enough said.
    - majkinetor 6y ago
jokethrowaway 6y ago
Government work is the worst example for quality. A monopoly without accountability having terrible practices doesn't surprise me. In all the private companies I worked either software was maintained or the feature wasn't in use anymore or the entire engineering team was about to be fired or the company itself had 2 months of life. I agree on your point regarding security, closing every vulnerability is impossible or not economically sound for many realities.
- majkinetor 6y ago
  > Government work is the worst example for quality. A monopoly without accountability having terrible practices doesn't surprise me. Exactly, the rules here are different and there is monopoly involved. Accountability is dispersed. However, if you freck up here and it shows, you are in the news tomorrow. Good luck finding job after that. On company level, you can be banned for years in entire gov sector. The big problem with that stance is however, that government usually doesn't do that work, it typically outsources to private companies that work on behalf of mega corps like Oracle, IMB etc. And they produce that "worst example of quality". So, its not about the type of company its much more complicated. > In all the private companies I worked either software was maintained or the feature wasn't in use anymore or the entire engineering team was about to be fired or the company itself had 2 months of life. I am sure this is not the norm either. You say it like there is some kind of sensor telling you when "feature wasn't in use anymore" - for some domains it can be easy, for majority its not however. Its understandable that people minimize the complexity of things involved here but that doesn't reflect reality. > I agree on your point regarding security, closing every vulnerability is impossible or not economically sound for many realities. Indeed. People act here like I said 0 security but I didn't - every professional worth its salt should do common "best practices", but going more then that needs serious thought, budget, planning etc. and it all depends on type of thing you do.

gypsyharlot 6y ago

"If you don't have a problem, there is no need to fix it" You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here. First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No one is going to change your desktop wallpaper to say "You have been hacked", like in the movies... Which leads me to the second point. What valuables does your organization have? Do you have recipes for a special kind of glue that your researchers spent a few million dollars inventing? Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? And what about the customers that buy your product? Do they care if all your communication with them, and any issues concerning this product that should only be known internally is widespread?

emilfihlman 6y ago
>You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here No it's you who is making assumptions and operating on "it must be this way" sense. Simply because a project has not had changes in a few years (or even many years) doesn't make the project insecure or bad. Can there be bugs or security issues? Or course, any software can have those, but merely change rate as you see on the project download page has no bearing on that.
majkinetor 6y ago
> You obviously don't have much experience with security and you make a lot of assumptions here. You obviously work in security and want to sell me bs. > First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No, you assume a lot about me while knowing 0. The bigger problem here is that you assume that people in corp care that there are hidden agents taking some data out. Let me open your eyes: they usually don't and ESPECIALLY if its not visible. If you replace their main site front page they will care. > What valuables does your organization have? Dude... go read my post again. > Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company. WHEN they care, I do it. Mine is to inform. Theirs to decide. Guess what: they always decide against it, naturally, as it costs more otherwise. Security is a feature. It costs money. It can be theoretically done forever and take infinite amount of money. In last decade I had just 1 stakeholder requesting "unbreakable system" and we did the best we could. Your main mistake seems to be to extrapolate your context to entire world. Context is everything.
- gypsyharlot 6y ago
  "> Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company." Enough said.
  - majkinetor 6y ago

jokethrowaway 6y ago

Government work is the worst example for quality. A monopoly without accountability having terrible practices doesn't surprise me. In all the private companies I worked either software was maintained or the feature wasn't in use anymore or the entire engineering team was about to be fired or the company itself had 2 months of life. I agree on your point regarding security, closing every vulnerability is impossible or not economically sound for many realities.

majkinetor 6y ago
> Government work is the worst example for quality. A monopoly without accountability having terrible practices doesn't surprise me. Exactly, the rules here are different and there is monopoly involved. Accountability is dispersed. However, if you freck up here and it shows, you are in the news tomorrow. Good luck finding job after that. On company level, you can be banned for years in entire gov sector. The big problem with that stance is however, that government usually doesn't do that work, it typically outsources to private companies that work on behalf of mega corps like Oracle, IMB etc. And they produce that "worst example of quality". So, its not about the type of company its much more complicated. > In all the private companies I worked either software was maintained or the feature wasn't in use anymore or the entire engineering team was about to be fired or the company itself had 2 months of life. I am sure this is not the norm either. You say it like there is some kind of sensor telling you when "feature wasn't in use anymore" - for some domains it can be easy, for majority its not however. Its understandable that people minimize the complexity of things involved here but that doesn't reflect reality. > I agree on your point regarding security, closing every vulnerability is impossible or not economically sound for many realities. Indeed. People act here like I said 0 security but I didn't - every professional worth its salt should do common "best practices", but going more then that needs serious thought, budget, planning etc. and it all depends on type of thing you do.