GitHub's Security Alert vs. My Abandoned Project
Description
This is a two-panel meme that contrasts a sense of urgency with apathy. The left panel is labeled 'Github telling me my project has a security vulnerability' and shows a young person with an orange bandana gesturing seriously, as if explaining something critical. The right panel is labeled 'My project which hasn't been touched in three years' and features a young woman tucked into a couch under a blanket, looking completely unbothered and staring into the distance. This meme humorously captures the developer experience of receiving automated security alerts, such as those from GitHub's Dependabot, for old, abandoned projects. While the notification is technically important, it's practically irrelevant for a codebase that is no longer maintained, used, or deployed, leading to the indifferent reaction depicted
Comments
7Comment deleted
My project's only user is the Dependabot scanner, so the biggest risk is the vulnerability getting its feelings hurt from being ignored
GitHub: “Critical lodash RCE in your repo.” Me: “If someone can resurrect a Node 6 build wired to Grunt and Bower, they’ve earned the remote code execution.”
That todo app from 2021 with 47 critical vulnerabilities is now perfectly secure - it's achieved the ultimate defense-in-depth by having dependencies so old that modern attack vectors haven't been invented yet
Ah yes, the classic Dependabot notification for that React 16 project from 2021 with 47 critical vulnerabilities in lodash 4.17.15. Sure, I'll get right on updating those dependencies - right after I migrate from Webpack 4, update Node from v12, fix the breaking changes in three major versions of every package, rewrite the entire build pipeline, and somehow remember what this project even does. Or, hear me out: we could just let it rest in peace in its private repo, where the only threat actor is my own guilt when GitHub sends the 127th security alert this quarter
CVSS 9.8 alert on an archived toy service; remediation is upgrading a transitive chain that drags React 16->18 and Webpack along, so the only thing we ship is a 'risk accepted' ticket
Dependabot is the only engineer still assigned to that 2019 service - its job is to remind me our attack surface has better uptime than the app ever did
GitHub security alerts: the only thing commit-ing to your three-year-dormant repo