| ▲ | loloquwowndueo 6 hours ago | |||||||||||||||||||||||||||||||
Nah - dependency cooldown is all the rage but it’s only effective if you have some noncompliant canary users. Once everyone is using it it will cease to be effective because nobody will be taking the first step/risk until everybody does. | ||||||||||||||||||||||||||||||||
| ▲ | moebrowne 6 hours ago | parent [-] | |||||||||||||||||||||||||||||||
The point of the cooldown is to allow time for vendor scans to complete and for compromised packages to be pulled. It's not about waiting for an end user to notice they've been compromised. > Meanwhile, the aforementioned vendors are scanning public indices as well as customer repositories for signs of compromise, and provide alerts upstream (e.g. to PyPI). https://blog.yossarian.net/2025/11/21/We-should-all-be-using... | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||