21
We should all be using dependency cooldowns (blog.yossarian.net)
submitted 11 months ago by to c/webdev@programming.dev
5 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 11 months ago (2 children)

No no no, I should be using dependency cooldowns. You all should be finding the vulnerabilities and getting them fixed before they reach me.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 2 points 11 months ago (1 child)

    I don't get your point. In most examples cited in the article, the supply chain attacks were found either by security researchers or maintainers realizing they did not intentionally push compromised version, not by everyday developers. The goal of dependency cooldowns is to give researchers and maintainers more time to detect attacks before they reach end-users.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •