Re:I booted Linux 292,612 times
by hedora on Wednesday June 14, 2023 @08:44PM
(#36334965)
That wouldn't work here though, the dependency started by breaking an almost-undetectable fraction of the time.
Imagine a scenario where your upstream dependency started out with one failure per 1,000,000 machine hours, then removed a zero once every 12 months. If you had 100 machines running tests at 100% efficiency, the bug would hit about once a year for the first year, then 10x the next year, and so on.
Put another way, if upstream is malicious, and you're not auditing every line of their source code, you're screwed.
Imagine a scenario where your upstream dependency started out with one failure per 1,000,000 machine hours, then removed a zero once every 12 months. If you had 100 machines running tests at 100% efficiency, the bug would hit about once a year for the first year, then 10x the next year, and so on.
Put another way, if upstream is malicious, and you're not auditing every line of their source code, you're screwed.