3 ms·
> But if everyone will be delaying updates, won't be there less chances to catch it in time? No: the security assumption behind cooldowns rests on security sca
by woodruffw 3mo ago
> But if everyone will be delaying updates, won't be there less chances to catch it in time?
No: the security assumption behind cooldowns rests on security scanning parties, not on innocent users being victimized. Three days is a short cooldown, but it should be a good enough lead for scanning parties.
> I'm not fully sure if it's possible to preventively scan all NPM packages or how much compute it would require.
It’s not that much data, particularly for parties that are directly financially incentivized to be the first to report malware.
- moralestapia 3mo agoDo you have an example of those things you're alleging? All package malware related news I see are related to users being affected by it (then security firms do their analysis whatever) ...
- klausa 3mo agoAnalysis and detection are not the same.
- woodruffw 3mo agoIf you google “supply chain security company” you will find various companies of various reputations vying for attention in this space.
- moralestapia 3mo agoDidn't find any. Found a lot scammers, though. Just post one link of a "supply chain" problem that was prevented by any of these companies before it went into the wild and affected users. Simple.
- woodruffw 3mo agoI generally try not to name the companies directly, because I don’t want to give them free advertising. But you can look up e.g. the recent Shai Hulud campaign. > Just post one link of a "supply chain" problem that was prevented by any of these companies before it went into the wild and affected users. This is not the claim being made, since cooldowns are not widely adopted at the moment.
- moralestapia 3mo agoI see. So, it has never happened before.
- woodruffw 3mo agoWell, yeah. There’s no package police that’ll stop you from installing malware. The argument has never revolved around that; the argument is solely that cooldowns are effective if you use them, and timely detection by third parties is strong evidence of that.
- moralestapia 3mo ago>and timely detection by third parties is strong evidence of that Do you have an example of those things you're alleging?
- woodruffw 3mo agoI gave Shai Hulud as an example above. If you want precise timeline examples that demonstrate the efficacy of cooldowns, here’s some examples I collected last year[1]. (See the “Window of opportunity” column in the table.) [1]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using...