3 ms·

I find that the issue is much more often not updating dependencies often enough with known security holes, than updating too often and getting hit with a supply

I find that the issue is much more often not updating dependencies often enough with known security holes, than updating too often and getting hit with a supply-chain malware attack.

sgc 1y ago
There have been several recent supply chain attacks that show attackers are taking advantage of this (previously sensible) mentality. So it is time to pivot and come up with better solutions before it spirals out of control.
- IgorPartola 1y ago
  A model that Linux distros follow would work to an extent: you have developed of packages and separate maintainers who test and decide to include or exclude packages and versions of packages. Imagine a JS distro which includes the top 2000 most popular libraries that are all known to work with each other. Your project can pull in any of these and every package is cryptographically signed off on by both the developers and the maintainer. Vulnerabilities in Linux distro packages obviously happen. But a single developer cannot push code directly into for example Debian and compromise the world.
dboreham 1y ago
Not updating is the other side of the same problem: library owners feel it is ok to make frequent backwards-compatibility breaking changes, often ignoring semver conventions. So consumers of their libraries are left with the choice to pin old insecure versions or spend time rewriting their code (and often transitive dependency code too) to keep up. This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free.
- banku_brougham 1y ago
  >This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free. Weirdly, some of the worst CVE I can think of were with enterprize software.
  - zelphirkalt 1y ago
    That's because there many people don't feel like it is their duty to do good work, even though they are paid ...
    - jand 1y ago
      Who do you mean with "many people"? Developers who do not care or middle management that oversold features and overcommitted w.r.t. deadlines? Or both? Someone else?
      - zelphirkalt 1y ago
        I was thinking of many developers, but actually middle management should be included.
        cutemonster 1y ago
        And the CEO. And lawmakers

I find that the issue is much more often not updating dependencies often enough with known security holes, than updating too often and getting hit with a supply-chain malware attack.

sgc 1y ago

There have been several recent supply chain attacks that show attackers are taking advantage of this (previously sensible) mentality. So it is time to pivot and come up with better solutions before it spirals out of control.

IgorPartola 1y ago
A model that Linux distros follow would work to an extent: you have developed of packages and separate maintainers who test and decide to include or exclude packages and versions of packages. Imagine a JS distro which includes the top 2000 most popular libraries that are all known to work with each other. Your project can pull in any of these and every package is cryptographically signed off on by both the developers and the maintainer. Vulnerabilities in Linux distro packages obviously happen. But a single developer cannot push code directly into for example Debian and compromise the world.

dboreham 1y ago

Not updating is the other side of the same problem: library owners feel it is ok to make frequent backwards-compatibility breaking changes, often ignoring semver conventions. So consumers of their libraries are left with the choice to pin old insecure versions or spend time rewriting their code (and often transitive dependency code too) to keep up. This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free.

banku_brougham 1y ago
>This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free. Weirdly, some of the worst CVE I can think of were with enterprize software.
- zelphirkalt 1y ago
  That's because there many people don't feel like it is their duty to do good work, even though they are paid ...
  - jand 1y ago
    Who do you mean with "many people"? Developers who do not care or middle management that oversold features and overcommitted w.r.t. deadlines? Or both? Someone else?
    - zelphirkalt 1y ago
      I was thinking of many developers, but actually middle management should be included.
      - cutemonster 1y ago
        And the CEO. And lawmakers