4 ms·

In the case where some rarely used feature is exploitable via some misconfiguration. See also: log4j

• dylan604 5y ago
  This is the thing. Is all of that 105MB vs 2MB of stuff the devs actually know exactly what it is and why it's there? As others have stated, the dependancy fluff is just a multitude of footguns cocked, locked, and ready to rock your world
• tgv 5y ago
  But how? I've got prometheus running in its own, non-root account. That makes exploiting vulnerabilities nearly useless, unless you can find a way to get it to spawn a process which can sudo. It runs behind nginx, which has a simple name/pwd protection on it. That makes it very hard to exploit. And prometheus only runs on one server; the others run node_exporter, or publish app data. What am I missing?
  • zufallsheld 5y ago
    You described multiple layers of security. Removing dependencies and stripping down code is the same: another layer of security.
  • ori_b 5y ago
    > What am I missing? If I knew, it would have a CVE number. However, the less code you have, the fewer the places there are where you need to ask that question.