Less is safer: how Obsidian reduces the risk of supply chain attacks

Re:Less is safer: how Obsidian reduces the risk of supply ch... by Scramblejams on Friday September 19, 2025 @07:42PM (#45308136)

Pinning dependencies also means you're missing any security fixes that come in after your pinned versions. That's asking for trouble too, so you need a protocol by which you become aware of these fixes and either backport them or upgrade to versions containing them.

[ Parent | on HN ]

Re:Less is safer: how Obsidian reduces the risk of supply ch... by kjkjadksj on Friday September 19, 2025 @07:57PM (#45308253)

All code is fundamentally not ever secure.

[ Parent | on HN ]

Re:Less is safer: how Obsidian reduces the risk of supply ch... by apstls on Friday September 19, 2025 @08:08PM (#45308337)

This statement is one of those useless exercises in pedantry like when people say "well technically coffee is a drug too, so..."

Code with publicly-known weaknesses pose exponentially more danger than code with unknown weaknesses.

It's like telling sysadmins to not waste time installing security patches because there are likely still vulnerabilities in the application. Great way to get n-day'd into a ransomware payment.

[ Parent | on HN ]

Re:Less is safer: how Obsidian reduces the risk of supply ch... by nightpool on Friday September 19, 2025 @08:48PM (#45308634)

Have you spent time reviewing the security patches for any nontrivial application recently? 90% of them are worthless, the 10% that are actually useful are pretty easy to spot. It's not as big of a deal as people would like to have you think.

[ Parent | on HN ]

Re:Less is safer: how Obsidian reduces the risk of supply ch... by da_chicken on Friday September 19, 2025 @07:59PM (#45308272)

That's why I run Windows 7. It's going to be insecure anyways so what's the big deal?

[ Parent | on HN ]

Re:Less is safer: how Obsidian reduces the risk of supply ch... by yen223 on Friday September 19, 2025 @11:03PM (#45309891)

Things like dependabot or renovate solves the problem of letting you know when security updates are available, letting you have your cake and eat it too.

[ Parent | on HN ]

Re:Less is safer: how Obsidian reduces the risk of supply ch... by skydhash on Saturday September 20, 2025 @07:34AM (#45312407)

> so you need a mechanism by which you become aware of these fixes and either backport them or upgrade to versions containing them

RSS Feeds?

[ Parent | on HN ]