Re:Automate GitHub Dependency Updates with Dependabot
by hermanradtke on Tuesday December 31, 2019 @01:53PM
(#21923434)
I wonder if there is any research on whether someone is better off not updating at all or automatically updating. I would bet that apps are better off automatically updating to remove published vulnerabilities than they are worrying about the handful of bitcoin wallet stealing backdoors. [1]
It comes down to trust. Automatically updating something like https://www.npmjs.com/package/express is probably pretty safe. Automatically updating a relatively unknown package made by an unknown person is much less safe.
Also, it goes beyond application dependency changes. What about your build server or that SaaS build pipeline you use? Key infrastructure gets hacked [2][3] and it turns out all the time you spent reviewing express updates should have instead been spent reviewing changes from somewhere else.
It comes down to trust. Automatically updating something like https://www.npmjs.com/package/express is probably pretty safe. Automatically updating a relatively unknown package made by an unknown person is much less safe.
Also, it goes beyond application dependency changes. What about your build server or that SaaS build pipeline you use? Key infrastructure gets hacked [2][3] and it turns out all the time you spent reviewing express updates should have instead been spent reviewing changes from somewhere else.
[1]: https://github.com/dominictarr/event-stream/issues/116
[2]: https://blog.linuxmint.com/?p=2994
[3]: https://blogs.adobe.com/security/2012/09/inappropriate-use-o...