News for hackers. Stuff that matters.

A comment on Embedded Malicious Code in node-ipc. Parent comment

Re:Embedded Malicious Code in node-ipc by ugh123 on Sunday March 20, 2022 @05:06PM (#30746626)
I think first thing would be to remove wildcards from version specs and lock them to your known, tested versions. Then only do upgrades after some time of stability in the ecosystem (i'd wait months, not days, for that)
[ Parent | on HN ]
Re:Embedded Malicious Code in node-ipc by kevinsundar on Sunday March 20, 2022 @05:08PM (#30746638)
Waiting months means you don't get security fixes for months.
[ Parent | on HN ]
Re:Embedded Malicious Code in node-ipc by userbinator on Sunday March 20, 2022 @05:09PM (#30746654)
It's known knowns vs unknown unknowns. I'd much rather have the former.
[ Parent | on HN ]