4 ms·
Not updating is the other side of the same problem: library owners feel it is ok to make frequent backwards-compatibility breaking changes, often ignoring semve
by dboreham 1y ago
Not updating is the other side of the same problem: library owners feel it is ok to make frequent backwards-compatibility breaking changes, often ignoring semver conventions. So consumers of their libraries are left with the choice to pin old insecure versions or spend time rewriting their code (and often transitive dependency code too) to keep up.
This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free.
- banku_brougham 1y ago>This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free. Weirdly, some of the worst CVE I can think of were with enterprize software.
- zelphirkalt 1y agoThat's because there many people don't feel like it is their duty to do good work, even though they are paid ...
- jand 1y agoWho do you mean with "many people"? Developers who do not care or middle management that oversold features and overcommitted w.r.t. deadlines? Or both? Someone else?
- zelphirkalt 1y agoI was thinking of many developers, but actually middle management should be included.
- cutemonster 1y agoAnd the CEO. And lawmakers