3 ms·

What's not clear to me is that newer software is safer or just less tested. Although it's possible that newer versions are more secure, I couldn't find evidenc

by azlev 3y ago

What's not clear to me is that newer software is safer or just less tested. Although it's possible that newer versions are more secure, I couldn't find evidence of it yet. (Links are welcome).

dboreham 3y ago
Probably more of an ass-covering situation: bugs are known in older software and not doing something about a known risk is obviously bad. otoh not mitigating an unknown and unidentified risk (bugs in new software) is ok.
wredue 3y ago
See. I used to think similarly. Newer software must be more secure, because we definitely know about all these problems and how to deal with them. What that doesn’t consider is that the vast majority of programmers simply don’t care to keep up with security concerns. And that’s why two of the most dangerous, easy to exploit, easy to stop attacks out there (SQL injection, XSS) are still among the most prevalent. As long as features are growing, the claims that new is more secure is difficult to believe.
dylan604 3y ago
that's why the whole rewrite in $languageX is so annoyingly frustrating when touted as fixing so many issues just because it uses $languageX. How many bugs not present in original version get introduce is always swept under the rug of the $languageX evangelists
Pet_Ant 3y ago
Isn't an unknown vulnerability preferrable to a known vulnerabilty?
- jossclimb 3y ago
  There is unknown and unreported, a large amount of unreported vulns are sold on the blackmarket or hoarded for exploit by foreign adversaries.
- iso1631 3y ago
  With a known vulnerability I can put in monitoring or countermeasures or work out that it doesn't affect me. With an unknown vulnerability, I don't have any information about it, it could be affecting me right now.
- bandrami 3y ago
  God no. The devil you know is always better.
jossclimb 3y ago
less tested..the vulnerabilities have not been found yet.
deleted 3y ago
[deleted]

by azlev 3y ago

What's not clear to me is that newer software is safer or just less tested. Although it's possible that newer versions are more secure, I couldn't find evidence of it yet. (Links are welcome).

dboreham 3y ago

Probably more of an ass-covering situation: bugs are known in older software and not doing something about a known risk is obviously bad. otoh not mitigating an unknown and unidentified risk (bugs in new software) is ok.

wredue 3y ago

See. I used to think similarly. Newer software must be more secure, because we definitely know about all these problems and how to deal with them. What that doesn’t consider is that the vast majority of programmers simply don’t care to keep up with security concerns. And that’s why two of the most dangerous, easy to exploit, easy to stop attacks out there (SQL injection, XSS) are still among the most prevalent. As long as features are growing, the claims that new is more secure is difficult to believe.

dylan604 3y ago

that's why the whole rewrite in $languageX is so annoyingly frustrating when touted as fixing so many issues just because it uses $languageX. How many bugs not present in original version get introduce is always swept under the rug of the $languageX evangelists

Pet_Ant 3y ago

Isn't an unknown vulnerability preferrable to a known vulnerabilty?

jossclimb 3y ago
There is unknown and unreported, a large amount of unreported vulns are sold on the blackmarket or hoarded for exploit by foreign adversaries.
iso1631 3y ago
With a known vulnerability I can put in monitoring or countermeasures or work out that it doesn't affect me. With an unknown vulnerability, I don't have any information about it, it could be affecting me right now.
bandrami 3y ago
God no. The devil you know is always better.

jossclimb 3y ago

less tested..the vulnerabilities have not been found yet.

deleted 3y ago

[deleted]