3 ms·
What’s a way to flag to an engineering team that they should do a thorough review of their usage of a particular API because it has footguns in it? This is a r
by catlifeonmars 2mo ago
What’s a way to flag to an engineering team that they should do a thorough review of their usage of a particular API because it has footguns in it?
This is a rhetorical question because there isn’t a generally accepted way of doing so. Automatically patch everything is a silly way to do vulnerability management but software is cheap to change, so it’s often easier at scale to just force engineering teams to patch even if it doesn’t make sense in context.
I’m not a fan of this approach, but I can understand why it’s so popular.
- masklinn 2mo agoYou could have a CO which emits overridable warnings or requires additional / specific reviewers. Of course that can then lead to warnings fatigue so it’s not necessarily a big improvement, or an improvement at all, in the long run, depends a lot on the org philosophy and habits.
- catlifeonmars 2mo agoWarning fatigue is a very good callout. I find it’s really easy to get to a state where you are inundated by notifications that aren’t actionable.