3 ms·
Because then you have to define what the package is going to do and it’s a lot of work. And now you don’t have to do that work. And of course, in this case it
by tinus_hn 5y ago
Because then you have to define what the package is going to do and it’s a lot of work. And now you don’t have to do that work.
And of course, in this case it only takes one app using this library that has a legitimate use case for unlimited acces. Unless you find a way to limit libraries separately.
- samwillis 5y ago“it’s a lot of work” should never be a reason for not securing an system. It’s also invite to solve a problem so it’s not a lot of work. It should be easy to secure your systems from making outbound connection.
- tinus_hn 5y agoIt’s trivial, just set up your firewall correctly! But if the system works when you block all outbound connections it’s also trivial to describe the required outbound connections: none. The problem is of course with the 99% of apps that do require some outbound connections.
- hxtk 5y ago> “it’s a lot of work” should never be a reason for not securing an system. It is, though. Software bugs are almost entirely optional: we could just formally verify every piece of software with a mathematical proof. Computer software would still be in the 70s or 80s because of how long that takes, but if security is the only goal of a system, that's what we need to be doing. In practice, projects balance a multitude of concerns and, while important, cybersecurity is only one of them. > It’s also invite to solve a problem so it’s not a lot of work. It should be easy to secure your systems from making outbound connection. This, I agree with wholeheartedly. The way to improve security is to address the factors that put humans in situations where skipping important security steps makes sense.