21–30 of 35 posts
ignore-scripts=true
Many popular Python libraries are available as Debian packages. Replacing pip/virtualenv dependencies with their distro-packaged equivalents firmly ties your projects to your distro and comes with other issues, but could also mean nearly automated updates for security patches. Advantages: 1. Security patches for free with distro package updates. 2. More consistency of dependency versions across projects. 3. Dependenc…
Earlier quoted context omitted.
> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their application littered with known vulnerabilities?
One argument, if the vulnerabilities don't affect you for whatever reason, it probably doesn't matter much. Lots of vulns these days have a fair load of caveats attached, and if they don't apply, one could argue upgrading is not required. Note: I'm not taking a stance on if I agree or not with this argument.
Earlier quoted context omitted.
One argument, if the vulnerabilities don't affect you for whatever reason, it probably doesn't matter much. Lots of vulns these days have a fair load of caveats attached, and if they don't apply, one could argue upgrading is not required. Note: I'm not taking a stance on if I agree or not with this argument.
Fair. But do most companies know whether the 638 child dependencies on affect them or not?
From what I can tell, there appears to be two camps. 1) Do not update dependencies (because updating to the latest version just because is silly) 2) Update dependencies (because security) Personally, I fall into the second group (with caveats). I've found that Dependabot helps with the tedious work of updating versions by hand but at the same time provides a check so that I manually approve. This seems to work out to…
> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their application littered with known vulnerabilities?
TBH most best practices preach for security by obscurity.
If you talk to any good vulnerabilities researcher - they will tell you what to really look out for.
Earlier quoted context omitted.
> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their application littered with known vulnerabilities?
If the application is not exposed to public internet - who cares ? TBH most best practices preach for security by obscurity. If you talk to any good vulnerabilities researcher - they will tell you what to really look out for.
From what I can tell, there appears to be two camps. 1) Do not update dependencies (because updating to the latest version just because is silly) 2) Update dependencies (because security) Personally, I fall into the second group (with caveats). I've found that Dependabot helps with the tedious work of updating versions by hand but at the same time provides a check so that I manually approve. This seems to work out to…
> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their application littered with known vulnerabilities?
The biggest correlated constant for bugs is that more lines of code = more bugs. As dependencies get updated they add more new features that I probably don't care about which adds more lines of code and therefore more bugs and security vulnerabilities.
I appreciate there is a balance between the two, but in my experience updating dependencies has broken things a lot more often than not updating things has broken things, and when that happens I find it a bit of a ridiculous idea that the maintainer has somehow made their product "more secure"(something that is usually a low dev priority) while at the same time introducing new bugs with the new features (something which is a higher dev priority) and they didn't even get that right.
On the topic of security, I am surprised there aren’t more safeguards for marketplace actions. I work in a larger organization and see that folks very much want to pull in actions that solve an immediate need without any type of vetting process. These actions are part of your build pipeline and can pose a substantial security threat. Dependabot does not currently scan for outdated or vulnerable marketplace actions. I…
From what I can tell, there appears to be two camps. 1) Do not update dependencies (because updating to the latest version just because is silly) 2) Update dependencies (because security) Personally, I fall into the second group (with caveats). I've found that Dependabot helps with the tedious work of updating versions by hand but at the same time provides a check so that I manually approve. This seems to work out to…