4 ms·

About open source lib not being updated : The thing is, even if the lib is "feature complete", it's pretty rare to not have to update anything, since the ecosy

by bsaul 4y ago

About open source lib not being updated : The thing is, even if the lib is "feature complete", it's pretty rare to not have to update anything, since the ecosystem in which this lib evolves will undoubtely have changed. Programming language, hardware, OS, etc. everything evolves all the time.

smt88 4y ago
Security threats also evolve all the time. A library that hasn't been updated in months is very likely an insecure library.
- FpUser 4y ago
  I use an ancient library to perform some math. It's been working just fine for more than 10 years without any need for update. Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. I think what you are saying is simply FUD when taken as a blanket statement.
  - x3n0ph3n3 4y ago
    Are you passing user input into it? Does it interact with anything on the system? Poorly sanitized inputs present a very serious risk for RCE vulnerabilities.
    - FpUser 4y ago
      As already said it is pure computational lib. It does not interact with anything and I use it from my code. There are tons of libraries like this. They work just fine, do not pose a security risk and have no need for update. But thanks for trying anyways.
  - smt88 4y ago
    > I use an ancient library to perform some math. Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day. The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security. > Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. You didn't specify the language or library. Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities. The mathjs package in NPM, for example, has had tons of vulnerabilities[1]. 1. https://security.snyk.io/package/npm/mathjs https://security.snyk.io/package/npm/mathjs
    - FpUser 4y ago
      C++ Library, forgot the name, need to look. NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".
- bromuro 4y ago
  Updates may be a security threat too… didn’t log4j become a security treat _because_ it had been updated?
7speter 4y ago
Theres a good chance the documentation could say things in a better way…
layer8 4y ago
This is only true if the ecosystem doesn’t care about compatibility, so this is just a symptom of a deeper issue. Say what you will about Wintel, but the long-term compatibility of x86 and Windows still lets me run a lot of win32 applications written two decades ago without issues.
- BeFlatXIII 4y ago
  I bet that if I moved back to Windows, KatMouse would work just as well as ever—and it was already nearly a decade out-of-date when I stopped being a daily Windows user.

by bsaul 4y ago

smt88 4y ago

Security threats also evolve all the time. A library that hasn't been updated in months is very likely an insecure library.

FpUser 4y ago
I use an ancient library to perform some math. It's been working just fine for more than 10 years without any need for update. Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. I think what you are saying is simply FUD when taken as a blanket statement.
- x3n0ph3n3 4y ago
  Are you passing user input into it? Does it interact with anything on the system? Poorly sanitized inputs present a very serious risk for RCE vulnerabilities.
  - FpUser 4y ago
    As already said it is pure computational lib. It does not interact with anything and I use it from my code. There are tons of libraries like this. They work just fine, do not pose a security risk and have no need for update. But thanks for trying anyways.
- smt88 4y ago
  > I use an ancient library to perform some math. Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day. The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security. > Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. You didn't specify the language or library. Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities. The mathjs package in NPM, for example, has had tons of vulnerabilities[1]. 1. https://security.snyk.io/package/npm/mathjs https://security.snyk.io/package/npm/mathjs
  - FpUser 4y ago
    C++ Library, forgot the name, need to look. NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".
bromuro 4y ago
Updates may be a security threat too… didn’t log4j become a security treat _because_ it had been updated?

7speter 4y ago

Theres a good chance the documentation could say things in a better way…

layer8 4y ago

This is only true if the ecosystem doesn’t care about compatibility, so this is just a symptom of a deeper issue. Say what you will about Wintel, but the long-term compatibility of x86 and Windows still lets me run a lot of win32 applications written two decades ago without issues.

BeFlatXIII 4y ago
I bet that if I moved back to Windows, KatMouse would work just as well as ever—and it was already nearly a decade out-of-date when I stopped being a daily Windows user.