Maybe you shouldn't install new software for a bit

Post by gwerbin » Fri, May 08, 2026, 1:03 PM UTC

whilenot-dev wrote: post #233

YZF wrote: post #191

Earlier quoted context omitted.

I worked for one company where we were super conservative. Every external component was versioned. Nothing was updated without review and usually after it had plenty of soak time. Pretty much everything built from source code (compilers, kernel etc.). Builds [build servers/infra] can't reach the Internet at all and there's process around getting any change in. We reviewed all relevant CVEs as they came out to make a…

You forgot case #4: Worked at a startup where the frontend team thought it was a good idea to use lock files during development, but to do a "fresh" install of all dependecies during the deployment step. And yes, they still thought they were doing the right thing.

Post by pocksuppet » Fri, May 08, 2026, 1:07 PM UTC

metaengies wrote: post #237

Actively destructive opinion article. I could not begin to understand the rationale. It takes 45 seconds to go check how old the copyfail and dirtyfrag vulnerabilities actually are. Which is longer than it takes to read TFA. Dirtyfrag may be relevant to systems from as far as 2017. It's not "new" software being affected. And actual old software is in a much worse state because we had a lot more time to find their pro…

Post by pocksuppet » Fri, May 08, 2026, 1:09 PM UTC

1718627440 wrote: post #270

pjmlp wrote: post #189

Earlier quoted context omitted.

Indeed, when one installs dependencies all over the Internet, or even better, key projects use "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" as default suggestion on how to install them, attackers have the work done for them.

> key projects use "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" as default suggestion This is exactly why some (including me) don't take these projects seriously. Like you claim to design a language for security, and this is how you tell me to install it????

Post by kam » Fri, May 08, 2026, 1:11 PM UTC

chubs wrote: post #136

To mitigate supply chain attacks like this, I've taken to specifying exact versions in my Rust cargo.toml, and when importing new crates, select the previous-to-latest version. Is this a reasonable mitigation? It bugs me that Swift deprecates the concept of specifying exact versions, it actively pushes you towards semver which leaves the door open to this.

Post by goodpoint » Fri, May 08, 2026, 1:13 PM UTC

cperciva wrote: post #30

eahm wrote: post #13

Earlier quoted context omitted.

Also funny they never show Debian in those tests/videos.

Debian is probably the best of all the Linuxes, but still suffers from split-brain: If patches are sent upstream first, Debian can't start digesting them until they're already public. With FreeBSD there's never any question of "who should this get reported to".