| ▲ | mbrumlow an hour ago | |
Are security updates immune ? | ||
| ▲ | tikkabhuna an hour ago | parent | next [-] | |
They definitely wouldn't be if attackers knew that it would then bypass cooldowns! Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases. | ||
| ▲ | dlkasajiewo an hour ago | parent | prev | next [-] | |
No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature. | ||
| ▲ | fmbb an hour ago | parent | prev | next [-] | |
It’s in the name. They are secure! | ||
| ▲ | mattstir an hour ago | parent | prev [-] | |
But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately. | ||