3 ms·
I don’t know why the industry collectively accepted these security scanners (code + containers) that don’t even do the most basic of static analysis to see if t
by cedws 8mo ago
I don’t know why the industry collectively accepted these security scanners (code + containers) that don’t even do the most basic of static analysis to see if the vulnerable code is reachable. Companies are breaking their backs trying to maintain a constant zero vulnerabilities in their container images when 99% of the CVEs don’t actually affect them anyway. The kicker is that updating the dependencies probably just introduces new CVEs to be discovered later down the line because most software does not backport fixes.
- eru 8mo ago> The kicker is that updating the dependencies probably just introduces new CVEs to be discovered later down the line because most software does not backport fixes. I don't understand how the second part of that sentence is connected to the first.
- cedws 8mo agoI could have written it more clearly. If you’re forced to upgrade dependencies to the latest version to get a patch, the upgrade likely contains new unrelated code that adds more CVEs. When fixes are backported you can get the patch knowing you aren’t introducing any new CVEs.