In my experience, keeping packages up-to-date is a great idea but really hard to do without adding ton of overhead, especially in the cloud space. As for the ar

In my experience, keeping packages up-to-date is a great idea but really hard to do without adding ton of overhead, especially in the cloud space. As for the argument of security, it's mostly legal. Security teams can basically said, we keep our system up-to-date, there isn't much we can do about it. This will pass muster in court, the board and general public. In cloud space, every team and numb nuts spin up endless EC2s, pip/node/apt-get install god-knows-what packages from god-knows-who developer(s) and build applications off that. No wonder security audit and keeping systems updated have become a nightmare. Back in the days when we keep our servers like pets, we can easily update and manage them because we squeeze out max performance, and carefully select packages that are applicable to all apps. It's a wonder we could get anything done fast enough.