Comments URL: https://news.ycombinator.com/item?id=47782174

Points: 1

# Comments: 0

To address the second airplane example, we really have to go through all that you're buying. Namely: more leg space, faster airport queue processing, more luggage, better in-flight service. Do I value these at 3x the cost? Maybe yes.

I'd argue for intentional dependency updates. It just so happens that it's identified in one sprint and planned for the next one, giving the team a delay.

First of all, sometimes you can reject the dependency update. Maybe there is no benefit in updating. Maybe there are no important security fixes brought by an update. Maybe it breaks the app in one way or another (and yes, even minor versions do that).

After you know why you want to update the dependency, you can start testing. In an ideal world, somebody would look at the diff before applying this to production. I know how this works in the real world, don't worry. But you have the option of catching this. If you automatically update to newest you don't have this option.

And again, all these rituals give you time - maybe someone will identify attacks faster. If you perform these rituals, maybe that someone will be you. Of course, it is better for the business to skip this effort because it saves time and money.

The issue is how much power this gives to the vendors. I think we should be able to survive a vendor going poof, taking all our data with them. Having a general computing platform capable of mixing files and privileges seems to me like the only way of keeping this capability.

But yes, these are the practical problems we need to address.

Another issue is that not paying up and risking restore from underfunded ops dept. might be more expensive than paying up AND making a selected executive look bad. And we can't have that, can we.

"I could have done it better, it's not a big deal, oh, they had women and non white people on board, what even is the shareholder value of this mission, oh it was almost done 50 years ago..."

These people went literally to the moon and back. Furthest anyone has ever been. That's an achievement.

I know things suck right now. Even more reasons to appreciate what is possible with technology.

I agree with the premise of this article. This achievement is inspiring and re-assuring that competency brings results. The alternative is way too depressing AND it mostly is our reality right know.

I agree that npm.org requiring MFA is a good idea in general and in this case.

A much better approach would be to pin the versions used and do intentional updates some time after release, say a sprint after.

Can you please share what and how gets degraded? Sometimes I don't like a phrase it selects, but it's not common

Comments URL: https://news.ycombinator.com/item?id=47249585

Points: 1

# Comments: 0