5 ms·

min release age to 7 days about patch releases exposes you to the other side of the coin, you have an open 7 days window on zero-day exploits that might be fixe

by cowl 6mo ago

min release age to 7 days about patch releases exposes you to the other side of the coin, you have an open 7 days window on zero-day exploits that might be fixed in a security release

ksnssjsjsj 6mo ago
Out of the frying pan and into the frier.....
freedomben 6mo ago
Exactly what I thought too when I read this... Urgent fix, patch released, invisible to dev team cause they put in a 7 day wait. Now our app is vulnerable for up to 7 days longer than needed (assuming daily deploys. If less often, pad accordingly). Not a great excuse as to why the company shipped an "updated" version of the app with a standing CVE in it. "Sorry we were blinded to the critical fix because set an arbitrary local setting to ignore updates until they are 7 days old". I wouldn't fire people over that, but we'd definitely be doing some internal training.
aetherspawn 6mo ago
Not really an issue though right because virtually none of these have lasted more than 1-2 days before being discovered?
tytho 6mo ago
At least with pnpm, you can specify minimumReleaseAgeExclude, temporarily until the time passes. I imagine the other package managers have similar options. [1]: https://pnpm.io/settings#minimumreleaseageexclude https://pnpm.io/settings#minimumreleaseageexclude
n_e 6mo ago
I haven't checked, but it would be surprising that the min-release-age applies to npm audit and equivalent commands
CGamesPlay 6mo ago
The packages that are actually compromised are yanked, but I assume you're talking about a scenario more like log4shell. In that case, you can just disable the config to install the update, then re-enable in 7 days. Given that compromised packages are uploaded all the time and zero-day vulnerabilities are comparatively less common, I'd say it's the right call.
- robertfw 6mo ago
  `uv` has per-package overrides, I imagine there may be similar in other managers

by cowl 6mo ago

min release age to 7 days about patch releases exposes you to the other side of the coin, you have an open 7 days window on zero-day exploits that might be fixed in a security release

ksnssjsjsj 6mo ago

Out of the frying pan and into the frier.....

freedomben 6mo ago

Exactly what I thought too when I read this... Urgent fix, patch released, invisible to dev team cause they put in a 7 day wait. Now our app is vulnerable for up to 7 days longer than needed (assuming daily deploys. If less often, pad accordingly). Not a great excuse as to why the company shipped an "updated" version of the app with a standing CVE in it. "Sorry we were blinded to the critical fix because set an arbitrary local setting to ignore updates until they are 7 days old". I wouldn't fire people over that, but we'd definitely be doing some internal training.

aetherspawn 6mo ago

Not really an issue though right because virtually none of these have lasted more than 1-2 days before being discovered?

tytho 6mo ago

At least with pnpm, you can specify minimumReleaseAgeExclude, temporarily until the time passes. I imagine the other package managers have similar options. [1]: https://pnpm.io/settings#minimumreleaseageexclude https://pnpm.io/settings#minimumreleaseageexclude

n_e 6mo ago

I haven't checked, but it would be surprising that the min-release-age applies to npm audit and equivalent commands

CGamesPlay 6mo ago

The packages that are actually compromised are yanked, but I assume you're talking about a scenario more like log4shell. In that case, you can just disable the config to install the update, then re-enable in 7 days. Given that compromised packages are uploaded all the time and zero-day vulnerabilities are comparatively less common, I'd say it's the right call.

robertfw 6mo ago
`uv` has per-package overrides, I imagine there may be similar in other managers