News for hackers. Stuff that matters.

A comment on Best practices to keep your projects secure on GitHub. Parent comment

Re:Best practices to keep your projects secure on GitHub by yjftsjthsd-h on Thursday April 28, 2022 @01:06PM (#31195067)
> Do not update dependencies (because updating to the latest version just because is silly)

That's quite the straw man; I seriously doubt that anybody is saying you shouldn't update because it's "silly". Blindly pulling updates is how you get compromised by supply chain attacks.

[ Parent | on HN ]
Re:Best practices to keep your projects secure on GitHub by newman314 on Thursday April 28, 2022 @01:25PM (#31195347)
Not naming names but certainly I've encountered open source projects that reject updating until the last possible second (end of life, security vulnerability etc.)
[ Parent | on HN ]
Re:Best practices to keep your projects secure on GitHub by yjftsjthsd-h on Thursday April 28, 2022 @01:38PM (#31195567)
That can be a function of effort, too; updates can be disruptive, and not everyone has the CI+testing infrastructure to handle it without significant manual work. There's a reason LTS distros are a thing.
[ Parent | on HN ]