71
Every dependency you add is a supply chain attack waiting to happen (benhoyt.com)
submitted 6 months ago by to c/technology@lemmy.world
12 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 6 months ago (3 children)

The careful reader may note that my title is not quite accurate. It’s not every dependency you add that’s a problem; it’s every dependency you update.

Why not put that in the title, Mr. Hoyt?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 13 points 6 months ago (2 children)

    Every dependency you don’t update is a zero day waiting to happen. All software carries risk.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    Every dependency you don’t update is a zero day waiting to happen. All software carries risk.

    In the same breath you're advocating updating without checking, and saying why that's an issue. You ... realize that, right?

    You're so close to realising the reason enterprise distros do backports.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •