> Quite broadly in tech, and especially in Enterprise, "new" versions of software are considered inherently insecure or unstable.
> But for all but .1% of Open Source, the opposite is true. Older versions do not contain critical fixes, including security patches.
> This is especially problematic in the "Enterprise Linux" world.
> You simply cannot get package managers to take new versions.


> OSS Reality Check:
> 1) Most projects are unmaintained.
> 2) Projects that are maintained only maintain the latest release line.
> 3) Dependency graphs are too large to be managed by humans. If you are a human un-supported by automation your deps are out of date.
> 4) Almost all the software you depend on contain undisclosed security vulnerabilities that, in the future, will be disclosed.

https://twitter.com/mikeal/status/911366255646351360