• 0 Posts
  • 26 Comments
Joined 3 years ago
cake
Cake day: June 11th, 2023

help-circle









  • Neither the position to keep all the old solutions because they are old nor to adopt all the new solutions because they are new is sensible.

    Some old solutions worked in the past and don’t work anymore because the actual world around us changed (the bits outside our control, e.g. some resources might be more sparse but were more plentiful in the past, human populations are larger, the world is more interconnected,…).

    Some old solutions appeared to work in the past because we didn’t have the knowledge about their flaws yet but now that we do we need new ones.

    Some new solutions are genuine improvements, others are merely sold by marketing and hype.

    Some new solutions have studies, data or even logic and math backing them up while others are adopted on a whim or even contrary to evidence or logic.

    We can not escape the fact that the world is complex and requires evaluation on a case by case basis and simplistic positions like “keep everything old” or “replace everything old” do not work.






  • Also, expanding on that, if you go into every interaction with a narrow expectation (e.g. to find the love of your life) you will be disappointed almost all the time but if you keep an open mind you might come out of that with some other positive interactions (a new friend, an interesting conversation, …) than you expected or were hoping for.


  • And I am saying that that information you are referring to is unknown for any given CVE unless it is unlocked by some investment of effort that usually far exceeds the effort to actually fix it and we already don’t have enough resources to fix all the bugs, much less assess the impact of every bug.

    Assessing the impact on the other hand is an activity that is only really useful for two things

    • a risk / impact assessment of an update to decide if you want to update or not
    • determining if you were theoretically vulnerable in the past

    You could add prioritizing fixes to that list but then, as mentioned, impact assessments are usually more work than actual fixes and spending more effort prioritizing than actually fixing makes no sense.


  • I am familiar with CVSS and its upsides and downsides. I am talking about the amount of resources required to determine that kind of information for every single bug, resources that far exceed the resources required to fix the bug.

    New bugs are introduced in backports as well, think of that Debian issue where generated keys had flaws for years because of some backport. The idea that any version, whether the same you have been using, the latest one or a backported one, will not gain new exploits or new known bugs is not something that holds up in practice.