3 ms·

We need cooldowns everywhere, by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should imp

We need cooldowns everywhere, by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.

srigi 6mo ago
That is why we have discussions like these: https://x.com/i/status/2039099810943304073 https://x.com/i/status/2039099810943304073
- tadfisher 6mo ago
  X is the worst place to hold community discussions.
eranation 6mo ago
Exactly this. For anyone who wants to do it for various package managers: ~/.npmrc: min-release-age=7 (npm 11.10+) ~/Library/Preferences/pnpm/rc: minimum-release-age=10080 (minutes) ~/.bunfig.toml [install]: minimumReleaseAge = 604800 (seconds) This would have protected the 334 people who downloaded @bitwarden/cli 2026.4.0 ~19h ago (according to https://www.npmjs.com/package/@bitwarden/cli?activeTab=versions https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi...). Same for axios last month (removed in ~3h). Doesn't help with event-stream-style long-dormant attacks but those are rarer. (plug: released a small CLI to auto-configure these — https://depsguard.com https://depsguard.com — I tried to find something that will help non developers quickly apply recommended settings, and couldn't find one)
- m4r71n 6mo ago
  https://cooldowns.dev/#javascript-ecosystem https://cooldowns.dev/#javascript-ecosystem ;-)
  - eranation 6mo ago
    Love it, I'll link to it!
tomjen3 6mo ago
I am not sure that works - imagine that the next shellshock had been found. Would you want to wait 7 days to update? We need to either screen everybody or cut of countries like North Korea and Iran from the Internet.
- tadfisher 6mo ago
  These vulnerabilities are all caught by scanners and the packages are taken down 2-3 hours after going live. Nothing needs to take 7 days, that's just a recommendation. But maybe all packages should be scanned, which apparently only takes a couple of hours, before going live to users?
- AgentME 6mo ago
  Shellshock was in 2014 and Log4Shell was 2021. It's far more likely that you're going to get pwned by using a too-recent unreviewed malicious package than to be unknowingly missing a security update that keeps you vulnerable to easy RCEs. And if such a big RCE vuln happens again, you're likely to hear about it and you can whitelist the update.

srigi 6mo ago

That is why we have discussions like these: https://x.com/i/status/2039099810943304073 https://x.com/i/status/2039099810943304073

tadfisher 6mo ago
X is the worst place to hold community discussions.

eranation 6mo ago

Exactly this. For anyone who wants to do it for various package managers: ~/.npmrc: min-release-age=7 (npm 11.10+) ~/Library/Preferences/pnpm/rc: minimum-release-age=10080 (minutes) ~/.bunfig.toml [install]: minimumReleaseAge = 604800 (seconds) This would have protected the 334 people who downloaded @bitwarden/cli 2026.4.0 ~19h ago (according to https://www.npmjs.com/package/@bitwarden/cli?activeTab=versions https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi...). Same for axios last month (removed in ~3h). Doesn't help with event-stream-style long-dormant attacks but those are rarer. (plug: released a small CLI to auto-configure these — https://depsguard.com https://depsguard.com — I tried to find something that will help non developers quickly apply recommended settings, and couldn't find one)

m4r71n 6mo ago
https://cooldowns.dev/#javascript-ecosystem https://cooldowns.dev/#javascript-ecosystem ;-)
- eranation 6mo ago
  Love it, I'll link to it!

tomjen3 6mo ago

I am not sure that works - imagine that the next shellshock had been found. Would you want to wait 7 days to update? We need to either screen everybody or cut of countries like North Korea and Iran from the Internet.

tadfisher 6mo ago
These vulnerabilities are all caught by scanners and the packages are taken down 2-3 hours after going live. Nothing needs to take 7 days, that's just a recommendation. But maybe all packages should be scanned, which apparently only takes a couple of hours, before going live to users?
AgentME 6mo ago
Shellshock was in 2014 and Log4Shell was 2021. It's far more likely that you're going to get pwned by using a too-recent unreviewed malicious package than to be unknowingly missing a security update that keeps you vulnerable to easy RCEs. And if such a big RCE vuln happens again, you're likely to hear about it and you can whitelist the update.