A routine gem update ended up creating $73k worth of subscriptions

Re:A routine gem update ended up creating $73k worth of subs... by sofixa on Friday January 07, 2022 @10:59PM (#29848500)

> I have pretty much determined everything in a project stays the same unless there's some pressing need

Unless you have a way to stay up to date with the security of each and every dependency you have, that seems dangerous. There are static security scanners out there which can parse your dependency tree and alert you, but often they have a high noise ratio ( e.g. npm audit), so that only helps so much.

[ Parent | on HN ]

Re:A routine gem update ended up creating $73k worth of subs... by chousuke on Saturday January 08, 2022 @03:44AM (#29849874)

The "easy" way to do this is to write your application using whatever is included in a stable Linux distribution.

You get free, trivially applied security updates and a much lower chance of breakage. Optionally you can pay for support to have them fix problems in dependencies.

Granted, It'll be difficult with languages like Javascript where many popular dependencies aren't likely to be packaged.

[ Parent | on HN ]

Re:A routine gem update ended up creating $73k worth of subs... by lordgroff on Friday January 07, 2022 @11:53PM (#29848731)

Application is airgapped, so it's not as dangerous as it sounds.

[ Parent | on HN ]