Hacker News Reader

Comment by rany_ | Hacker News Reader

If it weren't for CVEs it would be a lot more difficult to convince management to update the codebase and get rid of legacy crap even though I'm fully aware that almost all the CVEs don't apply to our project. It's just better for productivity/QOL.

I think it's normal that CVEs don't convey all the nuance and at the end of the day, it's up to you to make an assessment on whether you're vulnerable. Though curl CVE seems like nonsense no matter how you look at it, I could see it might be an issue if delay was being set by untrusted user... but they could also set a very short delay without taking advantage of this flaw. So moot point.

View on HN

That same management is the type to set rules where you don't get to assess if you're vulnerable, you just have to fix all the CVEs

And where if you beg them to allow code review (especially for the code made by your incompetent offshore teams) they say it's too expensive/uses too much developer time, but then they'll pay a subscription for garbage static analysis tools that's enough to cover multiple full time dev salaries.

Speaking purely hypothetically, of course.

The first paragraph is defending burning down the house every year or two, because that way you can change the curtains without pushback

Following the analogy further personally I find a controlled house burn preferable to self-combusting hazard curtains.

When the replacement house has a new random set of N self-combusting components where N>1 I'm not sure it's any safer.

The important thing is to keep building the house all of the time, gotta pay the bills somehow :)

Hell, SREs will tell you it's better this way - if you're regularly burning your house down and rebuilding it anew, there isn't time for maintenance problems to creep in!

What part of the paragraph do you equate to burning a house down? The assignment of a CVE number?

Marking a defect as critical in typical large co control governance leads promptly toward re-prioritizing work and sometimes disabling otherwise-online and profit-generating systems.

Some buyers insist on this in contracts with technology providers.

That feels very much like burning cash, even if it's lost profits and not technically destroying a tangible object.

Sounds like your company's governance is made entirely of pyromaniacs, I don't know why you feel a need to deflect the blame.

Reply on news.ycombinator.com