Mastodon Feed: Post

Mastodon Feed

Boosted by glyph ("Glyph"):
filippo@abyssdomain.expert ("Filippo Valsorda") wrote:

Again and again, demanding work from dozens or hundreds or thousands of unaffected dependents instead of fixing vulnerability scanners does not scale, and is a serious open source sustainability issue.

https://github.com/FiloSottile/age/issues/744 (do NOT dogpile on the reporter, call your vuln scanner vendor instead)

"I wake up" cat cycle meme, the cat is an open source maintainer, the pattern is "I get asked to update a dep to fix a vuln I'm not affected by because someone's vuln scanner sucks"