4 ms·

> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their appli

by mbesto 5y ago

> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their application littered with known vulnerabilities?

zie 5y ago
One argument, if the vulnerabilities don't affect you for whatever reason, it probably doesn't matter much. Lots of vulns these days have a fair load of caveats attached, and if they don't apply, one could argue upgrading is not required. Note: I'm not taking a stance on if I agree or not with this argument.
- mbesto 5y ago
  Fair. But do most companies know whether the 638 child dependencies on <insert JS library here> affect them or not?
  - zie 5y ago
    LOL! only 638? That might be low :)
pojzon 5y ago
If the application is not exposed to public internet - who cares ? TBH most best practices preach for security by obscurity. If you talk to any good vulnerabilities researcher - they will tell you what to really look out for.
- jimt1234 5y ago
  "We're not internet-facing, so we're not at risk, so we're not concerned with security." Standard misconception. I once worked with a team running a large Hadoop cluster. Everything in a private network. Nothing internet-facing. No risk, right? Well, a Python library they were importing got compromised and was using all their nodes to mine Monero. Oops! The cluster had been running for weeks. The only reason anyone knew about it was the performance of the cluster was terrible; all the CPUs were maxed, yet no jobs were running.
  - pojzon 5y ago
    This example is a borderline case. This means that not only they got hacked but also pip repo they were using. Which means that their provider also did not run any dependency scans. Tho if they fetched that from github open source repo -> yup thats just incompetence.
fizzynut 5y ago
On the other hand, how do developers sleep at night after updating their dependencies as it will now be littered with new unknown vulnerabilities. The biggest correlated constant for bugs is that more lines of code = more bugs. As dependencies get updated they add more new features that I probably don't care about which adds more lines of code and therefore more bugs and security vulnerabilities. I appreciate there is a balance between the two, but in my experience updating dependencies has broken things a lot more often than not updating things has broken things, and when that happens I find it a bit of a ridiculous idea that the maintainer has somehow made their product "more secure"(something that is usually a low dev priority) while at the same time introducing new bugs with the new features (something which is a higher dev priority) and they didn't even get that right.
- mbesto 5y ago
  > (something that is usually a low dev priority) I guess you just proved my point. Thanks.

by mbesto 5y ago

zie 5y ago

One argument, if the vulnerabilities don't affect you for whatever reason, it probably doesn't matter much. Lots of vulns these days have a fair load of caveats attached, and if they don't apply, one could argue upgrading is not required. Note: I'm not taking a stance on if I agree or not with this argument.

mbesto 5y ago
Fair. But do most companies know whether the 638 child dependencies on <insert JS library here> affect them or not?
- zie 5y ago
  LOL! only 638? That might be low :)

pojzon 5y ago

If the application is not exposed to public internet - who cares ? TBH most best practices preach for security by obscurity. If you talk to any good vulnerabilities researcher - they will tell you what to really look out for.

jimt1234 5y ago
"We're not internet-facing, so we're not at risk, so we're not concerned with security." Standard misconception. I once worked with a team running a large Hadoop cluster. Everything in a private network. Nothing internet-facing. No risk, right? Well, a Python library they were importing got compromised and was using all their nodes to mine Monero. Oops! The cluster had been running for weeks. The only reason anyone knew about it was the performance of the cluster was terrible; all the CPUs were maxed, yet no jobs were running.
- pojzon 5y ago
  This example is a borderline case. This means that not only they got hacked but also pip repo they were using. Which means that their provider also did not run any dependency scans. Tho if they fetched that from github open source repo -> yup thats just incompetence.

fizzynut 5y ago

On the other hand, how do developers sleep at night after updating their dependencies as it will now be littered with new unknown vulnerabilities. The biggest correlated constant for bugs is that more lines of code = more bugs. As dependencies get updated they add more new features that I probably don't care about which adds more lines of code and therefore more bugs and security vulnerabilities. I appreciate there is a balance between the two, but in my experience updating dependencies has broken things a lot more often than not updating things has broken things, and when that happens I find it a bit of a ridiculous idea that the maintainer has somehow made their product "more secure"(something that is usually a low dev priority) while at the same time introducing new bugs with the new features (something which is a higher dev priority) and they didn't even get that right.

mbesto 5y ago
> (something that is usually a low dev priority) I guess you just proved my point. Thanks.