3 ms·

I started playing with containerizing Excalidraw but noticed that there were a bunch of security issues identified by Dependabot. Given that you already have D

I started playing with containerizing Excalidraw but noticed that there were a bunch of security issues identified by Dependabot. Given that you already have Dependabot active, would you consider getting the dependencies somewhat up to date? Looks like the pull requests already exist... Thanks.

capableweb 5y ago
Dependabot is something like a modern plague of open source, together with the bot that closes issues automatically. Did you read through the security issues identified, familiar with the codebase enough that you can see that these issues are actually affecting the product? Most issues Dependabot opens on repositories I'm involved in, points to issues that has no bearing on the actual code, since it's security issues that are involving passing user code to specific functions, or simply regarding APIs that are never used in the first place. You don't have to be on the newest version of every single library, in most cases it doesn't make any sense to just upgrade for the sake of upgrade.
- richardfey 5y ago
  This. You are just swapping bugs that are known (and that in 99% of the cases do not affect you) with bugs that are not yet known (because of being always on tip release), for the sake of not willing to spend time checking if you actually need to upgrade. It does not correspond to higher security but rather a russian roulette game where you swap bullets with newer variants, all the time.
  - anotherhue 5y ago
    Agreed, but working out which are needed and which are safe often takes more time than simply rolling with the new release
    - capableweb 5y ago
      Yes, the tradeoff to get better security is more effort and more process.
      - vjeux 5y ago
        In all the years since it was rolled out, I’ve seen hundreds of security warnings but absolutely none was remotely close to a real security issue.
    - richardfey 5y ago
      This way you do not run software with less security issues, just software with not-yet-discovered ones. Create a GitHub native tools suite for LTS management of all releases of all languages/platforms, then we are talking about security.

capableweb 5y ago

Dependabot is something like a modern plague of open source, together with the bot that closes issues automatically. Did you read through the security issues identified, familiar with the codebase enough that you can see that these issues are actually affecting the product? Most issues Dependabot opens on repositories I'm involved in, points to issues that has no bearing on the actual code, since it's security issues that are involving passing user code to specific functions, or simply regarding APIs that are never used in the first place. You don't have to be on the newest version of every single library, in most cases it doesn't make any sense to just upgrade for the sake of upgrade.

richardfey 5y ago
This. You are just swapping bugs that are known (and that in 99% of the cases do not affect you) with bugs that are not yet known (because of being always on tip release), for the sake of not willing to spend time checking if you actually need to upgrade. It does not correspond to higher security but rather a russian roulette game where you swap bullets with newer variants, all the time.
- anotherhue 5y ago
  Agreed, but working out which are needed and which are safe often takes more time than simply rolling with the new release
  - capableweb 5y ago
    Yes, the tradeoff to get better security is more effort and more process.
    - vjeux 5y ago
      In all the years since it was rolled out, I’ve seen hundreds of security warnings but absolutely none was remotely close to a real security issue.
  - richardfey 5y ago
    This way you do not run software with less security issues, just software with not-yet-discovered ones. Create a GitHub native tools suite for LTS management of all releases of all languages/platforms, then we are talking about security.