3 ms·
They’re not bad if you give up on being able to reproduce arcane bugs. Don’t pin versions, pull everything from latest, CVEs are just a rebuild. Certainly not a
by everforward 2mo ago
They’re not bad if you give up on being able to reproduce arcane bugs. Don’t pin versions, pull everything from latest, CVEs are just a rebuild. Certainly not an amazing idea, but it solves the problem of the day.
The funnier, Kafakaesque problem of the day is interactions with mandatory cooldown periods on new versions because of supply chain risks.
I’ve had a couple tickets get stuck because the CVE scanner says I have to update, but the cooldown enforcer says the version hasn’t been out long enough.
- pixl97 2mo ago>Don’t pin versions In enterprise software..... I only dream of work where some ancient version isn't pinned because 200 person hours are need to adapt the code to newer versions. And the update versus cooldown are fun. Can't win either way you go.
- inigyou 2mo ago> Don't pin versions, pull everything from latest Rebuild broke half your tests. People are exploiting the CVE against your system right now. Good luck!
- pas 2mo agooh, it could be worse! spending time on fake CVEs while people are exploiting real 0days against your system.
- everforward 2mo agoYou can’t fail unit tests you don’t have because your agent “fixed” them by deleting them. You have to go full galaxy brain for it to work lol