4 ms·
If it is about a few highly specialized firms finding the vulns we should let them do it before publication and we do not need cooldowns. If it is not about th
by weinzierl 3mo ago
If it is about a few highly specialized firms finding the vulns we should let them do it before publication and we do not need cooldowns.
If it is not about that and we still subscribe to Linus's law then
cooldowns will just postpone the problem.
- StrauXX 3mo agoPublishing publicly then applying cooldowns in projects is much easier tgan establishing a new standard for pre-release security testing versions that works across ecosystems and gains zooling support.
- yuppiepuppie 3mo agoExactly this. The firms can follow the standard practices of the industry without needing to injection further process into the projects.
- weinzierl 3mo agoReleasing secure software is the right thing to do. We only release insecure software because we need the eyeballs to make it secure. If we believe the point made above that the many eyeballs are not that important then releasing before we have done everything to make the software as secure as possible is irresponsible.
- palky 3mo ago"We only release insecure software because we need the eyeballs to make it secure." No one is doing this on purpose, they believe the software to be secure when they release it... You shouldn't gate the release of a package until every single offsec research shop in the world has had a chance to look at it
- rcxdude 3mo agoThe cooldowns effectively make the initial push into the package repository into a pre-publishing step. It's pretty much isomorphic with what you're suggesting.