4 ms·

All things considered I'm not sure that'd be such a good thing How many security issues spring from outdated packages vs packages updated too hastily?

• denimnerd42 3y ago
  and when you do get a security issue and you're using a 10 year old version the upgrade is going to be really really difficult vs incremental upgrades when they are available. or are you going to fork and assume responsibility for that library code too?
• Hackbraten 3y ago
  On top of that: A newly-introduced security issue tends to have very limited exploitability, because it's valuable, not-yet well understood, and public exploits are yet to be developed. Compare to that a similar vulnerability in an older package: chances are that everything about it has been learned and is publicly known. Exploits have become a commodity and are now part of every offensive security distro on the planet. If you run that vulnerable version, there's a real risk that a non-targeted campaign will randomly bite you.
  • maerF0x0 3y ago
    > valuable, not-yet well understood, and public exploits Except in the scenario that is this exact case: Supply chain attacks that are developed with the exploit in mind.
    • Hackbraten 3y ago
      I agree in principle. But even if the backdoor is deliberate (as is the case here), there’s limited risk for the average person. Nobody in their right mind is going to attack Jane Doe and risk burning their multi-million dollar exploit chain. For an old vulnerability, however, any unpatched system is a target. So the individual risk for the average unpatched system is still orders of magnitude higher than in the former scenario.