Minimum Release Age is an Underrated Supply Chain Defense

6 months ago by codeinabox to c/security

A 7-day package delay would have blocked installs in most short-lived malicious publish attacks from the last 8 years
TomasEkeli 2 points 6 months ago

There is some truth to this - staying on the bleeding edge exposes you to things earlier.

Not really surprising, but maybe a consequence people who want to be on the latest version immediately did not consider. Good article!

path: 0 23175882, hotness: undefined, score: 2, children: 0
AntiBullyRanger -2 points 6 months ago

incompatible with capitalism

path: 0 23111806, hotness: undefined, score: -2, children: 4
duckythescientist 4 points 6 months ago

Did you comment this on the wrong post?

path: 0 23111806 23122014, hotness: undefined, score: 4, children: 3
AntiBullyRanger -1 points 6 months ago path: 0 23111806 23122014 23122355, hotness: undefined, score: -1, children: 2
duckythescientist 2 points 6 months ago

Do you expect there to be no crime and no money if capitalism is replaced? And effort toward mitigating supply chain hacks is definitely compatible with capitalism especially with such an easy mitigation as proposed in this article.

path: 0 23111806 23122014 23122355 23128837, hotness: undefined, score: 2, children: 1
AntiBullyRanger 0 points 6 months ago

But then your unsecure, cheap, and fast competitor will upload the features and solutions of your scope 14 days ahead of you, over and over again, until you're suddenly years behind the rest. Are this unaware of the modern business deployment model?

path: 0 23111806 23122014 23122355 23128837 23131184, hotness: undefined, score: 0, children: 0
security
security

@programming.dev

login for more options
2181
172
89

A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.

Rules :

  1. All instance-wide rules apply.
  2. Keep it totally legal.
  3. Remember the human, be civil.
  4. Be helpful, don't be rude.

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

go to feed...