alt Hacker News> Insecure software will be exploited this way or another, if the vulnerabilities are real and the threat model is valid.
The algorithm is: if the threat model is valid, there are vulnerabilities and you either have some software everybody knows about or a gang of hackers specifically targeting you, you should patch.
The part of the industry that profits from security theater will want you to patch no matter what, even if your business goes down in flames due to downtimes and new bugs introduced by patched components. They won't remind you to assess the threat model first.
Replies
kamma4434 • today at 9:14 AM
Explain that to the auditors… on whose lap does the decision fall?
➕ show 1 reply
Physical threat models and digital ones are completely different.
Digital threat models are very topologically flat. One exploit made in one place can be instantly copied and used anywhere.
Also once hacked you can be used as a base of operations to attack others. There is no neutrality on the internet.