3 ms·
The article puts the blame on > Never Update, Auto-Updates And Change Are Bad as the source of the problem a couple of times. This is pretty common take from
by sundarurfriend 2y ago
The article puts the blame on
> Never Update, Auto-Updates And Change Are Bad
as the source of the problem a couple of times.
This is pretty common take from security professionals, and I wish they'd also call out the other side of the equation: organizations bundling their "feature" (i.e. enshittification) updates and security updates together. "Always keep your programs updated" is just not feasible advice anymore given that upgrades as just as likely to be downgrades these days. If that were to be realistic advice, we need more pressure on companies to separate out security-related updates and allow people to get updates only on that channel.
- necovek 2y agoIn essence, you are agreeing that this is the root cause, you just seem to believe it's unrealistic to fix it. I actually think it's viable to fix, I am simply not sure if anyone would pay for it — basically, old LTS model from Linux distributions where a set of packages gets 5 or 10 years of guaranteed security updates (backported, maintaining backwards compatibility otherwise). If one was to start a business of "give me a list of your FLOSS dependencies and I'll backport security fixes for you for X", what's X for you?
- thrtythreeforty 2y agoAren't you just reinventing Red Hat?
- necovek 2y agoThat's the other way around (and also SuSE, Ubuntu LTS and even Debian stable): here are the things you can get security backports for vs here are the security backports for things you need.
- WeLostMcguffin 2y ago[flagged]