Dependabot version updates introduce default package cooldown
1–10 of 154 posts
Re: Dependabot version updates introduce default package cooldown
#2What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of (and uninterested in) protecting us.
Re: Dependabot version updates introduce default package cooldown
#3What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of (and uninterested in) protecting us.
No way to prevent this says only package manager where this regularly happens.
Re: Dependabot version updates introduce default package cooldown
#4What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of (and uninterested in) protecting us.
You cannot call it a supply chain, if you have zero contractual relationships with the authors of the solutions you are using.
Re: Dependabot version updates introduce default package cooldown
#5What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of (and uninterested in) protecting us.
You cannot call it a supply chain, if you have zero contractual relationships with the authors of the solutions you are using. [1] https://news.ycombinator.com/item?id=44434355
Oh that one really makes you think doesn’t it.
Re: Dependabot version updates introduce default package cooldown
#6What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of (and uninterested in) protecting us.
What would a solution to this look like?
What would it take to not fear installing software? This isn't a npm problem, its a computing problem in general. Spaces like this are generally pretty against any sort of restrictions or limitations being put on computers under the name of safety (see Manifest v3)
Re: Dependabot version updates introduce default package cooldown
#7This makes me think whether npm (and other registries) should apply security requirements based on ecosystem impact. Example a package having millions of downloads can have special security measures enforced.
Re: Dependabot version updates introduce default package cooldown
#8This makes me think whether npm (and other registries) should apply security requirements based on ecosystem impact. Example a package having millions of downloads can have special security measures enforced.
What would be a security measure that should only be selectively enforced?
Re: Dependabot version updates introduce default package cooldown
#9What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of (and uninterested in) protecting us.
You cannot call it a supply chain, if you have zero contractual relationships with the authors of the solutions you are using. [1] https://news.ycombinator.com/item?id=44434355
I mean, that’s just arguing over whether or not the definition of “supply” implies “compensation”, which isn’t very interesting imho.
The grandparent’s point remains the same, the software ecosystem and its supply chain or however you want to call it is a hot mess.
Re: Dependabot version updates introduce default package cooldown
#10This makes me think whether npm (and other registries) should apply security requirements based on ecosystem impact. Example a package having millions of downloads can have special security measures enforced.
What would be a security measure that should only be selectively enforced?
Higher cost (“Mythos” vs static code analysis) vulnerability scanning prior to successful merge to main branch or deployment as an artifact. As risk increases (popular code->greater exposure potential), increase automated, programmatic scrutiny on subject code to lower residual risk.
(application security and vulnerability management is a component of my work in financial services, thoughts and opinions always my own)