6 ms·
> If everyone sets a cooldown, there will be no early adopter. This ignores all the security companies & researchers screening packages.
by normie3000 2mo ago
> If everyone sets a cooldown, there will be no early adopter.
This ignores all the security companies & researchers screening packages.
- chmod775 2mo agoAlso ignores the common vector of the maintainer getting compromised and their credentials immediately being used to push malware. Most maintainer are going to notice that themselves.
- pixl97 2mo agoExactly, and the vast majority of the attack success is in a very short period of time. It will make credential attacks much harder to pull off successfully and the returns from using them will drop pretty dramatically.
- saghm 2mo agoIsn't this what alpha/beta/RC releases are for, ensuring that there are no issues before a general release? I just don't get ecosystem has decided to use client-side configurations for this rather than just marking the releases in the ways that already exist.
- pixl97 2mo agoWhen the attacker gets your npm/gh credentials they just publish a new 'full' release making your idea worthless.
- normie3000 2mo agoIf it helps, think of cooldown periods as a way to do staged rollouts.