2 ms·
This x 1000 I’ve been screaming this from the rooftops. Impact is what was always important. No one is going to take down prod to do an emergency patch on an R
by ofjcihen 4mo ago
This x 1000
I’ve been screaming this from the rooftops. Impact is what was always important. No one is going to take down prod to do an emergency patch on an RCE that COULD NEVER ACTUALLY BE EXPLOITED.
I feel like we’re witnessing the result of multiple roles suddenly becoming security aware but not having the background or understanding to make any sense of it.
- cpuguy83 4mo agoIn an ideal universe yes. But we live in a world where vulnerability scanners reign supreme.
- jamesfinlayson 4mo agoYep, I've updated dependencies with an RCE that can't be exploited in my codebase just to keep my security team happy. Not worth the multiple arguments about it not actually being an issue.
- StrauXX 4mo agoYou can never guarantee that the codepath of a dependency that is vulnerable can not be reached or used as a gadget in an exploit chain. Patching dependencies, even when no direct vulnerability arises is an essential part of defense in depth and sevurity hygene.
- sass_muffin 4mo agoYou can also never guarantee the patched software doesn't include a worse vulnerability, I would submit that patching software without proper time to validate changes is also a security issue. If you aren't careful, that is how you get this security theater.
- jamesfinlayson 4mo agoI don't disagree, though I should have been more specific - I updated dependencies at extremely short notice because that's what security wanted. I would have updated the dependencies sooner or later anyway because I know that periodically updating dependencies is generally a good thing to do.