3 ms·
What if libinsecure 0.2.1 is the version that introduces the vulnerability, do you still want your application to pick up the update? I think the better model
by deredede 1y ago
What if libinsecure 0.2.1 is the version that introduces the vulnerability, do you still want your application to pick up the update?
I think the better model is that your package manager let you do exactly what you want -- override libuseful's dependency on libinsecure when building your app.
- trjordan 1y agoOf course there's no 0-risk version of any of this. But in my experience, bugs tend to get introduced with features, then slowly ironed out over patches and minor versions. I want no security bugs, but as a heuristic, I'd strongly prefer the latest patch version of all libraries, even without perfect guarantees. Code rots, and most versioning schemes are designed with that in mind.
- MarkusQ 1y agoExcept the only reason code "rots" is that the environment keeps changing as people chase the latest shiny thing. Moreover, it rots _faster_ once the assumption that everyone is going to constantly update get established, since it can be used to justify pushing non-working garbage, on the assumption "we'll fix it in an update". This may sound judgy, but at the heart it's intended to be descriptive: there are two roughly stable states, and both have their problems.