3 ms·
It's wild that none of these are set by default. I know 90% of people I've worked with will never know these options exist.
by sspiff 6mo ago
It's wild that none of these are set by default.
I know 90% of people I've worked with will never know these options exist.
- zelphirkalt 6mo agoIf everyone or a majority of people sets these options, then I think issues will simply be discovered later. So if other people run into them first, better for us, because then the issues have a chance of being fixed once our acceptable package/version age is reached.
- po1nt 6mo agoThat would likely mean same amount of people get the vulnerability, just 7 days later.
- user34283 6mo agoThe compromised packages were removed from the registry within hours.
- brabel 6mo agoBecause everyone got updates immediately. If the default was 7 days, almost no one would get updates immediately but after 7 days, and now someone only finds about after 7 days. Unless there is a poor soul checking packages as they are published that can alert the registry before 7 days pass, though I imagine very few do that and hence a dedicated attacker could influence them to not look too hard.
- Leherenn 6mo agoIf I remember correctly, in all the recent cases it was picked up by automated scanning tools in a few hours, not because someone updated the dependency, checked the code and found the issue. So it looks like even if no one actually updates, the vast majority of the cases will be caught by automated tools. You just need to give them a bit of time.