3 ms·
Yes, some places suck. They're going to suck either way. If their system is so backwards that they need to manually patch services because everything is EOL, an
by staticassertion 5y ago
Yes, some places suck. They're going to suck either way. If their system is so backwards that they need to manually patch services because everything is EOL, and compiled code will break their workflow, they have plenty of other shit to deal with.
I don't think we should optimize for garbage companies with garbage practices.
- rocqua 5y agoI'd say places lie on a spectrum of sucking. With a lot of places being very important and far from perfect. Those places really should get good security. That means designing for security in the common situation rather than the situation of 'best practices'. I think we should optimize security for say the 80th percentile company as far as not following best practices (i.e. 80% of companies have better practices than what I suggest targeting).
- staticassertion 5y agoIn no way is manually writing a patch and then live patching the common situation. The vast majority of cases, and this has been the case for decades, will be that you take responsibility for your own dependencies, and you let your vendors take responsibility for theirs.