8 ms·

Not updating old libraries is how you end up getting known security vulns years after they are patched.

lopkeny12ko 4y ago
You should ask your colleagues who work in critical industries like banking and healthcare how much of their software stack depends on things that haven't been patched in more than 20 years ;)
- precommunicator 4y ago
  Healthcare developer here, developing for German market, we've used Java preview features and unstable React versions many times before. And we literally have two different roles on our team for upgrading vulnerable dependencies whenever we get an alert.
- lavishlatern 4y ago
  I've worked in healthcare, I find the software practices absolutely atrocious. The consequence of this has been ransomware attacks: https://www.usnews.com/news/health-news/articles/2022-10-10/patient-care-delayed-at-large-hospital-chain-after-ransomware-attack https://www.usnews.com/news/health-news/articles/2022-10-10/... https://www.bloomberg.com/news/features/2023-02-03/ireland-hospital-ransomware-attack-fractured-hacker-group-conti https://www.bloomberg.com/news/features/2023-02-03/ireland-h... https://floridapolitics.com/archives/585686-tallahassee-memorial-hospital-victim-of-suspected-ransomware-attack/ https://floridapolitics.com/archives/585686-tallahassee-memo... https://www.oceancitytoday.com/news/atlantic-general-hospital-system-still-down-following-ransomware-attack/article_8e01738c-a897-11ed-b3c3-5b2eeb3ca239.html https://www.oceancitytoday.com/news/atlantic-general-hospita...
- blandflakes 4y ago
  Both industries that are notorious for poor security hygiene, so I'm not sure this is the coup you were looking for.
- throwaway2037 4y ago
  "critical industries like banking and healthcare". What a red herring. This comment reads like ChatGPT was trained on Reddit forums. 99% of the software in those industries runs "inside the moat" where security doesn't matter. I am still running log4j from 10 years ago in lots of my stack, and it is the swiss cheese of software security! Who cares! It works! I'm inside the moat! If people want to do dumb black hat stuff, they get fired. Problem solved. Also what does "banking" mean anyway? That comment is so generic as to be meaningless. If you are talking about Internet-facing retail banks in 2023, most are very serious about security... because regulations, and giants fines when they get it wrong. And if the fines aren't large enough in your country, tell your democratically elected officials to 10x the fines. It will change industry behaviour instantly -- see US investment banks' risk taking after the Vocker Rule/Dodd-Frank regulations.
  - saagarjha 4y ago
    > If people want to do dumb black hat stuff, they get fired. Firing people doesn’t get you un-hacked. When your risk model involves threats coming from the inside (and at sufficient scale and value it definitely should) then you want to harden things internally too.
  - dx034 4y ago
    I don't think it matters much if you're inside the moat. Running vulnerable software inside the moat makes it very easy for an attacker to move laterally once they're in. Patching everything where possible reduces the blast radius of an attack massively.
- geraldwhen 4y ago
  I know devs in several and you can’t even deploy to QA if a dependency has a known vulnerability.

You should ask your colleagues who work in critical industries like banking and healthcare how much of their software stack depends on things that haven't been patched in more than 20 years ;)

precommunicator 4y ago
Healthcare developer here, developing for German market, we've used Java preview features and unstable React versions many times before. And we literally have two different roles on our team for upgrading vulnerable dependencies whenever we get an alert.
lavishlatern 4y ago
I've worked in healthcare, I find the software practices absolutely atrocious. The consequence of this has been ransomware attacks: https://www.usnews.com/news/health-news/articles/2022-10-10/patient-care-delayed-at-large-hospital-chain-after-ransomware-attack https://www.usnews.com/news/health-news/articles/2022-10-10/... https://www.bloomberg.com/news/features/2023-02-03/ireland-hospital-ransomware-attack-fractured-hacker-group-conti https://www.bloomberg.com/news/features/2023-02-03/ireland-h... https://floridapolitics.com/archives/585686-tallahassee-memorial-hospital-victim-of-suspected-ransomware-attack/ https://floridapolitics.com/archives/585686-tallahassee-memo... https://www.oceancitytoday.com/news/atlantic-general-hospital-system-still-down-following-ransomware-attack/article_8e01738c-a897-11ed-b3c3-5b2eeb3ca239.html https://www.oceancitytoday.com/news/atlantic-general-hospita...
blandflakes 4y ago
Both industries that are notorious for poor security hygiene, so I'm not sure this is the coup you were looking for.
throwaway2037 4y ago
"critical industries like banking and healthcare". What a red herring. This comment reads like ChatGPT was trained on Reddit forums. 99% of the software in those industries runs "inside the moat" where security doesn't matter. I am still running log4j from 10 years ago in lots of my stack, and it is the swiss cheese of software security! Who cares! It works! I'm inside the moat! If people want to do dumb black hat stuff, they get fired. Problem solved. Also what does "banking" mean anyway? That comment is so generic as to be meaningless. If you are talking about Internet-facing retail banks in 2023, most are very serious about security... because regulations, and giants fines when they get it wrong. And if the fines aren't large enough in your country, tell your democratically elected officials to 10x the fines. It will change industry behaviour instantly -- see US investment banks' risk taking after the Vocker Rule/Dodd-Frank regulations.
- saagarjha 4y ago
  > If people want to do dumb black hat stuff, they get fired. Firing people doesn’t get you un-hacked. When your risk model involves threats coming from the inside (and at sufficient scale and value it definitely should) then you want to harden things internally too.
- dx034 4y ago
  I don't think it matters much if you're inside the moat. Running vulnerable software inside the moat makes it very easy for an attacker to move laterally once they're in. Patching everything where possible reduces the blast radius of an attack massively.
geraldwhen 4y ago
I know devs in several and you can’t even deploy to QA if a dependency has a known vulnerability.