> If everyone sets a cooldown, there will be no early adopter.

This ignores all the security companies & researchers screening packages.

chmod775 5 hours ago | parent | next [-]

Also ignores the common vector of the maintainer getting compromised and their credentials immediately being used to push malware.

Most maintainer are going to notice that themselves.

	▲	pixl97 4 hours ago \| parent [-]
		Exactly, and the vast majority of the attack success is in a very short period of time. It will make credential attacks much harder to pull off successfully and the returns from using them will drop pretty dramatically.

▲

saghm 4 hours ago | parent | prev [-]

Isn't this what alpha/beta/RC releases are for, ensuring that there are no issues before a general release? I just don't get ecosystem has decided to use client-side configurations for this rather than just marking the releases in the ways that already exist.

	▲	pixl97 4 hours ago \| parent \| next [-]
		When the attacker gets your npm/gh credentials they just publish a new 'full' release making your idea worthless.
	▲	normie3000 4 hours ago \| parent \| prev [-]
		If it helps, think of cooldown periods as a way to do staged rollouts.