News for hackers. Stuff that matters.

A comment on We All Dodged a Bullet. Parent comment

Re:We All Dodged a Bullet by stickfigure on Tuesday September 09, 2025 @12:41PM (#45184602)
It wouldn't be a problem if there wasn't a culture of "just upgrade everything all the time" in the javascript ecosystem. We generally don't have this problem with Java libraries, because people pick versions and don't upgrade unless there's good reason.
[ Parent | on HN ]
Re:We All Dodged a Bullet by ilvez on Tuesday September 09, 2025 @01:41PM (#45185525)
From maintenance perspective both never and always seem like extremes though.

Upgrading when falling off the train is serious drawback on moving fast..

[ Parent | on HN ]
Re:We All Dodged a Bullet by 0xDEAFBEAD on Tuesday September 09, 2025 @11:44PM (#45192976)
Maybe we need two upgrade paths: An expedited auto-upgrade path which requires multi-key signoff from various trusted developers, and a standard upgrade path which is low-pressure.
[ Parent | on HN ]
Re:We All Dodged a Bullet by jcelerier on Tuesday September 09, 2025 @02:21PM (#45186194)
and then you get Log4Shell
[ Parent | on HN ]