3 ms·
> * Don't always immediately updated to the newest version. If it's compromised, give the other users and the vendor time to find the vulnerability. It always
by rtkwe 5y ago
> * Don't always immediately updated to the newest version. If it's compromised, give the other users and the vendor time to find the vulnerability.
It always feels like advise that relies on not everyone following it is cheating just a bit.
- openfuture 5y agoIt itsn't depending on everyone not following it, it is just incomplete; you should review the code or wait for someone you trust to review the code or ,,,do what GP recommends.
- remram 5y agoUpdating to the latest version and running it shouldn't be how you review them for dependencies. You can follow the development of a few packages you care about and review them immediately, while not blindly running cutting-edge everything at all times.
- beagle3 5y agoDifferent actors have significantly different security preferences / concerns and risk/reward profiles with respect to new features. Almost everyone could be following it -- everyone, if you trust the vendor actually dogfoods -- and it would still work. I wait a few months. Someone else only waits a week.