4 ms·
Some scattered thoughts on this: * Don't always immediately updated to the newest version. If it's compromised, give the other users and the vendor time to fin
by perlgeek 5y ago
Some scattered thoughts on this:
* Don't always immediately updated to the newest version. If it's compromised, give the other users and the vendor time to find the vulnerability.
* Try to rely on software packaged by somebody you trust.
* Reduce potential impact of compromise by using 2FA with something off your dev machine (like authenticator app on your phone).
> What's the bar for reasonable security, in your opinion?
That really depends on your situation.
Do you think somebody might target you, specifically? Has your machine been compromised before? Do you do anything with potentially high leverage for an attacker?
If the answer is "no" to all these, I'd say don't sweat it too much beyond standard "best practices".
- rtkwe 5y ago> * Don't always immediately updated to the newest version. If it's compromised, give the other users and the vendor time to find the vulnerability. It always feels like advise that relies on not everyone following it is cheating just a bit.
- openfuture 5y agoIt itsn't depending on everyone not following it, it is just incomplete; you should review the code or wait for someone you trust to review the code or ,,,do what GP recommends.
- remram 5y agoUpdating to the latest version and running it shouldn't be how you review them for dependencies. You can follow the development of a few packages you care about and review them immediately, while not blindly running cutting-edge everything at all times.
- beagle3 5y agoDifferent actors have significantly different security preferences / concerns and risk/reward profiles with respect to new features. Almost everyone could be following it -- everyone, if you trust the vendor actually dogfoods -- and it would still work. I wait a few months. Someone else only waits a week.