Whytheluckystiff's original domain back as an archive

Re:Whytheluckystiff's original domain back as an archive by rsanheim on Thursday August 18, 2022 @03:26PM (#32513820)

I could've been more clear in my original post. I'm not just thinking about "getting an app running": ruby, rbenv, and bundler has had that solved for many years, and npm, nvm (or whatever and js is stable there as well.

If you take any app built three years ago, you are going to have critical security vulns in libraries you depend on. With java think of the log4j fiasco. With Ruby there are nokogiri or rails things. With javascript there are probably at least a handful of downstream packages that have pretty big security issues. Now you have to update dependencies, and then the real fun begins.

If it a walled-off intranet app on a VPN, or a small CLI app, sure, maybe you can ignore that issue. But if its a public web or mobile app that is gonna see real use, you are going to have to head down the security audit + package update rabbit-hole.

[ Parent | on HN ]

Re:Whytheluckystiff's original domain back as an archive by shadowgovt on Friday August 19, 2022 @11:37AM (#32522341)

For what I do in my day-to-day, security vulnerabilities are reported by `npm` automatically when updating packages and there are several pieces of nice tooling around identifying the versions that exhibit the vulnerability and getting around them.

I think the `npm` community is going in the right direction and learning from mistakes of the past on this topic.

[ Parent | on HN ]