4 ms·

If it weren't for CVEs it would be a lot more difficult to convince management to update the codebase and get rid of legacy crap even though I'm fully aware tha

by rany_ 3y ago

If it weren't for CVEs it would be a lot more difficult to convince management to update the codebase and get rid of legacy crap even though I'm fully aware that almost all the CVEs don't apply to our project. It's just better for productivity/QOL. I think it's normal that CVEs don't convey all the nuance and at the end of the day, it's up to you to make an assessment on whether you're vulnerable. Though curl CVE seems like nonsense no matter how you look at it, I could see it might be an issue if delay was being set by untrusted user... but they could also set a very short delay without taking advantage of this flaw. So moot point.

nikanj 3y ago
The first paragraph is defending burning down the house every year or two, because that way you can change the curtains without pushback
- lpapez 3y ago
  Following the analogy further personally I find a controlled house burn preferable to self-combusting hazard curtains.
  - zaphar 3y ago
    When the replacement house has a new random set of N self-combusting components where N>1 I'm not sure it's any safer.
    - lpapez 3y ago
      The important thing is to keep building the house all of the time, gotta pay the bills somehow :)
      - TeMPOraL 3y ago
        Hell, SREs will tell you it's better this way - if you're regularly burning your house down and rebuilding it anew, there isn't time for maintenance problems to creep in!
- remram 3y ago
  What part of the paragraph do you equate to burning a house down? The assignment of a CVE number?
  - lq9AJ8yrfs 3y ago
    Marking a defect as critical in typical large co control governance leads promptly toward re-prioritizing work and sometimes disabling otherwise-online and profit-generating systems. Some buyers insist on this in contracts with technology providers. That feels very much like burning cash, even if it's lost profits and not technically destroying a tangible object.
    - remram 3y ago
      Sounds like your company's governance is made entirely of pyromaniacs, I don't know why you feel a need to deflect the blame.
bcassedy 3y ago
That same management is the type to set rules where you don't get to assess if you're vulnerable, you just have to fix all the CVEs
- HideousKojima 3y ago
  And where if you beg them to allow code review (especially for the code made by your incompetent offshore teams) they say it's too expensive/uses too much developer time, but then they'll pay a subscription for garbage static analysis tools that's enough to cover multiple full time dev salaries. Speaking purely hypothetically, of course.

by rany_ 3y ago

nikanj 3y ago

The first paragraph is defending burning down the house every year or two, because that way you can change the curtains without pushback

lpapez 3y ago
Following the analogy further personally I find a controlled house burn preferable to self-combusting hazard curtains.
- zaphar 3y ago
  When the replacement house has a new random set of N self-combusting components where N>1 I'm not sure it's any safer.
  - lpapez 3y ago
    The important thing is to keep building the house all of the time, gotta pay the bills somehow :)
    - TeMPOraL 3y ago
      Hell, SREs will tell you it's better this way - if you're regularly burning your house down and rebuilding it anew, there isn't time for maintenance problems to creep in!
remram 3y ago
What part of the paragraph do you equate to burning a house down? The assignment of a CVE number?
- lq9AJ8yrfs 3y ago
  Marking a defect as critical in typical large co control governance leads promptly toward re-prioritizing work and sometimes disabling otherwise-online and profit-generating systems. Some buyers insist on this in contracts with technology providers. That feels very much like burning cash, even if it's lost profits and not technically destroying a tangible object.
  - remram 3y ago
    Sounds like your company's governance is made entirely of pyromaniacs, I don't know why you feel a need to deflect the blame.

bcassedy 3y ago

That same management is the type to set rules where you don't get to assess if you're vulnerable, you just have to fix all the CVEs

HideousKojima 3y ago
And where if you beg them to allow code review (especially for the code made by your incompetent offshore teams) they say it's too expensive/uses too much developer time, but then they'll pay a subscription for garbage static analysis tools that's enough to cover multiple full time dev salaries. Speaking purely hypothetically, of course.