21–30 of 288 posts
If the software you are using auto-updates and you lose business or esteem of peers -- it's YOUR fault. Allowing most software companies to update anything on an running functioning work-related machine that you use to make $$, is ASKING FOR IT. WHEN it breaks something that is your fault for being so stupid. I update software in most cases by installing it on another machine/device and then once it is confirmed to w…
If the software you are using auto-updates and you lose business or esteem of peers -- it's YOUR fault. Allowing most software companies to update anything on an running functioning work-related machine that you use to make $$, is ASKING FOR IT. WHEN it breaks something that is your fault for being so stupid. I update software in most cases by installing it on another machine/device and then once it is confirmed to w…
Ignoring upstream security fixes on a work-related machine that you use to make $$, is ASKING FOR IT. WHEN it breaks something that is your fault for being so stupid.
Neither of these extremisms are helpful. It's clearly more nuanced than any of this.
The worst place to be is having to fix a CVE in a hurry, but first having to upgrade your framework a few major versions including fixing some breaking API changes. I’d rather pay a small tax every month than have to risk those late nights.
Dependabot is great here, you can get updates for free, or at least preview if they are going to pass all your tests.
I'm not sure if this is a joke or not.
"My premise is that updates are a massive waste of time, most of the time. Obviously, someone will jump out and say that "Hey, if you don't update, your Windows XP installation will get added to a botnet in less than a week," and they'll also be right at the same time. "
So my understanding is, when compared to a academical, idealistic point of view, handling of updates is not optimal. Sure thing.
But in reality, you still must patch your WinXP system if you have no better alternative and the author likely agrees. And if you do have a shitty legacy java project that is still needed in production - you still have to patch it, if you have to use it in the wild.
As a red teamer/pentester, this is an attacker's dream. This has to be a joke.
Also, this disclaimer in the very first sentence of the article:
> "Here's a fair warning: this article is reductio ad absurdum"
If the software you are using auto-updates and you lose business or esteem of peers -- it's YOUR fault. Allowing most software companies to update anything on an running functioning work-related machine that you use to make $$, is ASKING FOR IT. WHEN it breaks something that is your fault for being so stupid. I update software in most cases by installing it on another machine/device and then once it is confirmed to w…
Having two of everything is actually a pretty decent idea. Part of the fear of updating though is the time sink. Even if I attempt to update one mac laptop to the new version (of which I believe there is a new one just released, doesn’t seem long since I last updated…) knowing that I have a safe backup, I dread the thought of spending hours knowing something _should_ be working but is now broken. It can be infuriatin…
Or just one, exposing your data in a ransom attack.
Dependency and update management is hard. Welcome to IT.
From my experience, extreme viewpoints and religions are convenient in the way they have answers to all hard questions in life that are simple, clear and wrong.
If you like simple and correct answers, you're usually better off choosing simple questions instead.
It's frustrating when you update in order to get the latest security updates - and you get forced to do a bunch of pointless busywork because some asshole has made some arbitrary change like deciding that 'which' is deprecated now.
DOS 5.2 ftw
Boots immediately too.
If the software you are using auto-updates and you lose business or esteem of peers -- it's YOUR fault. Allowing most software companies to update anything on an running functioning work-related machine that you use to make $$, is ASKING FOR IT. WHEN it breaks something that is your fault for being so stupid. I update software in most cases by installing it on another machine/device and then once it is confirmed to w…
If you're running software maintained by someone else and you don't let them do that, and there's a security or major bug fix and you lose business or esteem of peers -- it's YOUR fault. Ignoring upstream security fixes on a work-related machine that you use to make $$, is ASKING FOR IT. WHEN it breaks something that is your fault for being so stupid. Neither of these extremisms are helpful. It's clearly more nuanced…
As a red teamer/pentester, this is an attacker's dream. This has to be a joke.