11–20 of 287 posts
I hate this. Delaying real bugfixes to achieve some nebulous poorly defined security benefit is just bad engineering.
Do you upgrade all your dependencies every day ? If not, then there’s no real difference in upgrading as if it were 7 days ago.
I hate this. Delaying real bugfixes to achieve some nebulous poorly defined security benefit is just bad engineering.
Do you upgrade all your dependencies every day ? If not, then there’s no real difference in upgrading as if it were 7 days ago.
Of course we talk about OS security upgrades here, not library dependencies. But the attack vector is similar.
I hate this. Delaying real bugfixes to achieve some nebulous poorly defined security benefit is just bad engineering.
Do you upgrade all your dependencies every day ? If not, then there’s no real difference in upgrading as if it were 7 days ago.
If upgrading like that scares you, your automated testing isn't good enough.
On average, the most bug free Linux experience is to run the latest version of everything. I wasted much more time backporting bugfixes before I started doing that, than I have spent on new bugs since.
Doesn't this mean you're leaving yourself open to known vulnerabilities during that "cool down" time?
A sane "cooldown" is just for automated version updates relying on semantic versioning rules, which is a pretty questionable practice in the first place, but is indeed made a lot more safe this way.
You can still manually update your dependency versions when you learn that your code is exposed to some vulnerability that's purportedly been fixed. It's no different than manually updating your dependency version when you learn that there's some implementation bug or performance cliff that was fixed.
You might even still use an automated system to identify these kinds of "critical" updates and bring them to your attention, so that you can review them and can appropriately assume accountability for the choice to incorporate them early, bypassing the cooldown, if you believe that's the right thing to do.
Putting in that effort, having the expertise to do so, and assuming that accountability is kind of your "job" as a developer or maintainer. You can't just automate and delegate everything if you want people to be able to trust what you share with them.
I hate this. Delaying real bugfixes to achieve some nebulous poorly defined security benefit is just bad engineering.
Do you upgrade all your dependencies every day ? If not, then there’s no real difference in upgrading as if it were 7 days ago.
Earlier quoted context omitted.
Do you upgrade all your dependencies every day ? If not, then there’s no real difference in upgrading as if it were 7 days ago.
Your CI/CD might be setup to upgrade all your dependencies on every build.
A lot of security problems can be solved by moving slower.