3 ms·
I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logi
by stephbook 1mo ago
I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logic is still working.
Add to that the danger of supply-chain attacks where you don't even want automatic updates.
- talon8635 1mo agoYour last point is the conundrum I keep running up against It’s a trap regardless: A) run a known vuln B) accept and run any and all updates immediately… which could be compromised Maybe A is worse because it’s a known vuln?
- xboxnolifes 1mo agoI prefer the devil I know over the one I dont. At least I can make judgement calls with vulnerabilities im aware of. Automatic updates have unbounded risk.
- Leherenn 1mo agoAI auditing of dependency updates will mostly likely come soon (if it's not already there), and should mitigate the most obvious cases at least. (By this I mean integrated in something like dependabot, not just some security companies doing it and publishing reports.)