Hacker News Reader

Enterprise also doesn't really care. It is just another box to tick and an excel sheet to fill out, correctness isn't actually required. You just need something to put in the list, so you may as well purchase something wrong but authoritative-looking in bulk.

View on HN

When some new version of log4j comes about and everyone is scrambling to find out where it resides, the cybersecurity team is going to hate the crappy checkbox solution that doesn't actually work.

Which is pretty much the norm.

40% of all log4j downloads are still vulnerable versions.

Nobody cares, it's just another checkbox/policy. Security team is just another compliance department. It does not bring in money.

> Security team is just another compliance department. It does not bring in money.

This. Thanks for highlight it!

It might be required and audited for software deployed to / interacting with government cloud. Eventually it will have to be correct too, as otherwise would be a security risk.

Yes, but that is an expense for a future faraway fiscal year.

Reply on news.ycombinator.com