3 ms·
If you google “supply chain security company” you will find various companies of various reputations vying for attention in this space.
by woodruffw 3mo ago
If you google “supply chain security company” you will find various companies of various reputations vying for attention in this space.
- moralestapia 3mo agoDidn't find any. Found a lot scammers, though. Just post one link of a "supply chain" problem that was prevented by any of these companies before it went into the wild and affected users. Simple.
- woodruffw 3mo agoI generally try not to name the companies directly, because I don’t want to give them free advertising. But you can look up e.g. the recent Shai Hulud campaign. > Just post one link of a "supply chain" problem that was prevented by any of these companies before it went into the wild and affected users. This is not the claim being made, since cooldowns are not widely adopted at the moment.
- moralestapia 3mo agoI see. So, it has never happened before.
- woodruffw 3mo agoWell, yeah. There’s no package police that’ll stop you from installing malware. The argument has never revolved around that; the argument is solely that cooldowns are effective if you use them, and timely detection by third parties is strong evidence of that.
- moralestapia 3mo ago>and timely detection by third parties is strong evidence of that Do you have an example of those things you're alleging?
- woodruffw 3mo agoI gave Shai Hulud as an example above. If you want precise timeline examples that demonstrate the efficacy of cooldowns, here’s some examples I collected last year[1]. (See the “Window of opportunity” column in the table.) [1]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using...