This is only true if the ecosystem doesn’t care about compatibility, so this is just a symptom of a deeper issue. Say what you will about Wintel, but the long-term compatibility of x86 and Windows still lets me run a lot of win32 applications written two decades ago without issues.

I bet that if I moved back to Windows, KatMouse would work just as well as ever—and it was already nearly a decade out-of-date when I stopped being a daily Windows user.

Theres a good chance the documentation could say things in a better way…

Security threats also evolve all the time. A library that hasn't been updated in months is very likely an insecure library.

I use an ancient library to perform some math. It's been working just fine for more than 10 years without any need for update. Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation.

I think what you are saying is simply FUD when taken as a blanket statement.

> I use an ancient library to perform some math.

Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day.

The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security.

> Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation.

You didn't specify the language or library.

Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities.

The mathjs package in NPM, for example, has had tons of vulnerabilities[1].

1. https://security.snyk.io/package/npm/mathjs

C++ Library, forgot the name, need to look.

NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".

Are you passing user input into it? Does it interact with anything on the system? Poorly sanitized inputs present a very serious risk for RCE vulnerabilities.

As already said it is pure computational lib. It does not interact with anything and I use it from my code. There are tons of libraries like this. They work just fine, do not pose a security risk and have no need for update.

But thanks for trying anyways.

Updates may be a security threat too… didn’t log4j become a security treat _because_ it had been updated?