News for hackers. Stuff that matters.

A comment on Third High Severity CVE in Log4j Is Published. Parent comment

Re:Third High Severity CVE in Log4j Is Published by rocqua on Sunday December 19, 2021 @12:50PM (#29616251)
I'd say places lie on a spectrum of sucking. With a lot of places being very important and far from perfect. Those places really should get good security. That means designing for security in the common situation rather than the situation of 'best practices'.

I think we should optimize security for say the 80th percentile company as far as not following best practices (i.e. 80% of companies have better practices than what I suggest targeting).

[ Parent | on HN ]
Re:Third High Severity CVE in Log4j Is Published by staticassertion on Sunday December 19, 2021 @03:12PM (#29617855)
In no way is manually writing a patch and then live patching the common situation.

The vast majority of cases, and this has been the case for decades, will be that you take responsibility for your own dependencies, and you let your vendors take responsibility for theirs.

[ Parent | on HN ]