TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Benefits to Keeping Packages Updated?

6 点作者 Guid_NewGuid将近 2 年前
In light of the Moq issue yesterday[0] I&#x27;m interested to understand why the consensus seems to be so in favor of keeping packages up-to-date in software.<p>The common explanation I see is it &quot;keeps you up to date with security and bug fixes&quot;.<p>But in practice this seems to just involve most orgs mandating Dependabot and mindlessly updating every dependency when a new version becomes available. (Yes in an ideal world you code review every change in every dependency, but... I mean, let&#x27;s be real here. Just take the update frequency of the AWS SDK packages in isolation, very few orgs are actually doing this)<p>As a maintainer of an open source library I know most releases are a crapshoot, they&#x27;re just as likely to contain new bugs and flaws as they are to fix old ones.<p>So staying up-to-date seems to open up codebases to far greater risks than outdated dependencies:<p>1) Zero days, a new package launches with some critical security flaw that isn&#x27;t going to get noticed for some time.<p>2) Supply chain attacks, old packages are generally immutable. Therefore most supply chains attacks seem to involve take-overs of existing package (name)s by disgruntled or new hostile &#x27;maintainers&#x27;. The new versions are far more at risk.<p>3) New bugs, the dirty truth of OSS is most work is done by unpaid people with little time or ability to focus. Most software isn&#x27;t formally verified. New updates are a risk.<p>In addition the old version is a known quantity. Unless you know absolutely the version you are running is compromised (log4j, OpenSSL) what benefits does updating actually bring? The default presumption that version number goes up is better seems like yet more security&#x2F;compliance cargo cult behavior.<p>What am I missing here?<p>[0] https:&#x2F;&#x2F;github.com&#x2F;moq&#x2F;moq&#x2F;issues&#x2F;1374

6 条评论

toast0将近 2 年前
I&#x27;m not a fan of blindly updating; I&#x27;d rather read the changelogs and decide if I need to update or not, but I sort of understand the utility of it. Most testing happens against the latest release version or HEAD in version control. If the version you&#x27;re running has different behavior than those two versions and the change wasn&#x27;t well documented, and the behavior in your version is problematic, it&#x27;s not likely that other people will discuss it and call your attention to it. Even if people run into that bug, they may just update and move on, rather than post about it being broken.<p>Depending on the project, and the changes involved, sometimes it&#x27;s beneficial to upgrade frequently and make required integration changes in small increments rather than say once a year with a big change. Sometimes, it&#x27;s much worse to follow the changes; some projects churn <i>a lot</i> and integration changes are kind of fixed per release, letting releases pile up means less overall work in that case.<p>Also, if you get support from upstream (which IMHO is a big if), they&#x27;ll tend to prefer for you to be working on a current version. You tend not to get much support when you&#x27;re running older versions. OTOH, I&#x27;m not used to having a support workflow. It&#x27;s often too hard to engage with external developers, so either the external software works, or you make changes so it works, without discussing with upstream.
aynyc将近 2 年前
In my experience, keeping packages up-to-date is a great idea but really hard to do without adding ton of overhead, especially in the cloud space. As for the argument of security, it&#x27;s mostly legal. Security teams can basically said, we keep our system up-to-date, there isn&#x27;t much we can do about it. This will pass muster in court, the board and general public.<p>In cloud space, every team and numb nuts spin up endless EC2s, pip&#x2F;node&#x2F;apt-get install god-knows-what packages from god-knows-who developer(s) and build applications off that. No wonder security audit and keeping systems updated have become a nightmare.<p>Back in the days when we keep our servers like pets, we can easily update and manage them because we squeeze out max performance, and carefully select packages that are applicable to all apps. It&#x27;s a wonder we could get anything done fast enough.
Am4TIfIsER0ppos将近 2 年前
If you don&#x27;t keep your software update you end up trying to write AVX2 instructions on systems in which the debuggers or analysis tools don&#x27;t understand them. Or the same but newer with AVX512.<p>Unfortunately updating also means you get people like Debian which patch bugs into the software they distribute; which isn&#x27;t really updated. The SSL or SSH key bug from something like 10 years ago and the memory leak in Transmission much more recently.<p>I am certainly for never updating when you think you have a working system. I am experienced regret after updating my desktop the time I managed 100+ days of uptime. So many pieces of software are worse since.
评论 #37078258 未加载
yen223将近 2 年前
Automatically keeping packages up-to-date used to be good advice, but now the ROI for exploiting automatically-updated libraries is high enough that I don&#x27;t think it&#x27;s true anymore.<p>This is more true once you factor in the non-security-related problems with not pinning your dependencies (e.g. when the Cryptography library in PyPI decided to introduce a Rust dependency and broke many people&#x27;s builds as a result)<p>I&#x27;ve settled for the middle ground of<p>- pinning all dependencies<p>- using something like Snyk to monitor for vulnerabilities in dependencies.<p>- manually updating dependencies that are known to be vulnerable
cpach将近 2 年前
Zero-day exploits can occur for any version of a software component or application. Staying on old versions is definitely not a protection against those exploits.
pabs3将近 2 年前
The solution is distributed code review:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;crev-dev&#x2F;">https:&#x2F;&#x2F;github.com&#x2F;crev-dev&#x2F;</a>