We should all be using dependency cooldowns (blog.yossarian.net)

Article summary

The article discusses the concept of dependency cooldowns as a way to mitigate open source supply chain attacks. A cooldown is a window of time between when a dependency is published and when it's considered suitable for use, allowing supply chain security vendors to scan for malicious changes. The author argues that implementing cooldowns can prevent the majority of supply chain attacks. The article also notes that cooldowns are easy to implement and can be enforced through tools like Dependabot and Renovate.

Main themes

• Dependency management
• Supply chain security
• Open source risks
• Cooldown periods
• Automated updates
• Security vulnerabilities

What commenters say

• Implementing a cooldown period for dependencies can help prevent supply chain attacks by allowing time for security vulnerabilities to be discovered and reported.
• Some argue that cooldowns can delay the deployment of bug fixes and introduce new risks, such as leaving users vulnerable to known vulnerabilities during the cooldown period.
• Others believe that cooldowns are not a silver bullet and that a more effective approach would be to promote best practices for manually reviewing and testing dependencies before deploying them to production.
• There is disagreement on whether cooldowns would reduce the number of eyeballs on new code, potentially decreasing the chances of discovering security issues, or if it would actually increase scrutiny as developers would be more likely to investigate patch notes and test updates in isolation.
• Some commenters argue that upgrading dependencies frequently, even daily, is necessary to stay ahead of zero-day exploits, while others believe that this approach can introduce new risks and that a more cautious approach is needed.
• The use of automated updates and lockfiles is also discussed, with some arguing that they can simplify dependency management, while others see them as a potential source of problems.