4 ms·
Your boss apparently doesn't really care about security posture... which is a shame. Most software that's 2 years old, much less 4 years old, is missing numerou
by ezekg 3y ago
Your boss apparently doesn't really care about security posture... which is a shame. Most software that's 2 years old, much less 4 years old, is missing numerous security patches introduced in more recent versions. But I guess you could be in an industry that doesn't run up-to-date software? Typically, 2-4 years is EOL.
- cxr 3y agoThe source code to the fixed versions is still available in those cases, and there's essentially no chance that even verbatim copies of the patches for most security fixes would pass the threshold of creativity to be copyrightable. Worst case scenario, you have to work with another person to have them study the fixes that upstream publishes and then explain the vulnerability to you so you can write a fix of your own.
- ezekg 3y agoSo essentially you pay your engineers to maintain a fork, so you can use the software for "free." Then the question of "build vs buy" eventually arises, because maintaining a fork is a costly maintenance burden, and is essentially the "build" side of that question. Seems like the license would be working as intended then. ;) Besides, this assumes you're creating a competing work. Most use cases of FSL can self-host the latest code. That's the whole point.
- arp242 3y agoFor something like Sentry that's typically not a huge problem. Only the "receive errors from application" endpoints needs to be public; everything else can be gated behind a VPN or HTTP password or whatever. While it's certainly true that such an endpoint can have security problems, it's a pretty small surface area. Besides, what kind of interesting stuff is there in Sentry? When configured correctly, probably not too much, depending on what type of app you're using it with.