> App makers are perfectly capable of shipping their own security updates now that we have cloud auto-updating whenever we want it. A large third-party depende

> App makers are perfectly capable of shipping their own security updates now that we have cloud auto-updating whenever we want it. A large third-party dependency chain is, in my opinion, the most problematic security risk in modern software. Secondly, automatic updates are how we got cloud-strike. I’m not advocating Debian style dependency sharing, but I am advocating for tight control and auditing over your dependency chain (which will mean building more in house). And allowing IT departments to control update rollouts.