> Those are far more common than malicious updates Are they though? It seems to me that security updates that actually affect a given individual or company are

> Those are far more common than malicious updates Are they though? It seems to me that security updates that actually affect a given individual or company are few and far between. Example: I use a library that both reads and writes a particular file format. In the past few years, it has literally had hundreds of potential vulnerabilities fixed in its parsing code. I only use it to write files, so most or all of its vulnerabilities are of no importance to me. How often do log4j-level RCEs (or of equal severity) happen? And of those, how many occur in JS packages hosted on NPM? In my opinion, when I'm using code from an untrusted source that neither I or anyone else has carefully reviewed, it is less risky to wait to patch until I am sure a change will improve my security posture versus YOLOing everything into production. But there is no right answer to this problem. We are all unknowingly running vulnerable code, and will at some point likely will make an update that introduces more vulnerable code. With the current state of our industry, we will all be owned at some point. It becomes a blame game - "you didn't apply the security patches?!" versus "you deployed code you didn't review?!".