this post was submitted on 12 Apr 2026
12 points (92.9% liked)
Security
2039 readers
6 users here now
A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.
Rules :
- All instance-wide rules apply.
- Keep it totally legal.
- Remember the human, be civil.
- Be helpful, don't be rude.
Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Not updating with audit would work if every direct and transient dependency provided security updates for every version. But they don't. Often, security updates are for the most recent version or versions, and if you're far behind, you now have to audit a lot more.
Transient dependencies are an audit problem, too. To audit something, you have to essentially audit recursively. Many libs use many other libs of varied authors.
Our systems are too open, too vulnerable. A build or check being able to access all resources is a fundamental systematic vulnerability.