News for hackers. Stuff that matters.

A comment on Less is safer: how Obsidian reduces the risk of supply chain attacks. Parent comment

Re:Less is safer: how Obsidian reduces the risk of supply ch... by cosmic_cheese on Friday September 19, 2025 @07:50PM (#45308189)
The real answer is to minimize dependencies (and subdependencies) to the greatest extent practical. In some cases you can get by with surprisingly few without too much pain (and in the long run, maybe less pain than if you'd pulled in more).
[ Parent | on HN ]
Re:Less is safer: how Obsidian reduces the risk of supply ch... by Scramblejams on Friday September 19, 2025 @08:06PM (#45308314)
Yep, and for the rest I've gotten a lot of mileage, when shipping server apps, by deploying on Debian or Ubuntu* and trying to limit my dependencies to those shipped by the distro (not snap). Their security teams worry about keeping my dependencies patched and I'm not forced to take new versions until I have to upgrade to the next OS version, which could be quite a long time.

It's a great way to keep lifecycle costs down and devops QoL up, especially for smaller shops.

* Insert favorite distro here that backports security fixes to stable package versions for a long period of time.

[ Parent | on HN ]