3 ms·
> vulnerability drops that impacts you project severely well if it's a regex ddos in build tooling, it doesn't "impact your project severly". That's the entire
by inbx0 5y ago
> vulnerability drops that impacts you project severely
well if it's a regex ddos in build tooling, it doesn't "impact your project severly". That's the entire point of this thread
- charcircuit 5y agoI never said it did. I am saying that if it's hard to patch irrelevant issues it is also hard to patch relevant issues. The ideal would be it is easy to patch all issues so you can always just upgrade to a safe version.
- inbx0 5y agoSure, but that's not something you can fix at the ecosystem level, it requires effort from the package maintainers and/or researchers to backport these fixes to older versions. And if the fix requires effort from the maintainers that is not actually very benefical to anyone (i.e. the vulnerability does not actually impose a security risk) then we are back to the question if it's really worth it. The effort has just been moved from the consumer to the library author.