Comment by 0c3ca83
10 hours ago
The last time I looked for information, I remember seeing that the median supply chain attack was in place for multiple months to years before being discovered. Cooldowns shorter than that seem like snake oil.
10 hours ago
The last time I looked for information, I remember seeing that the median supply chain attack was in place for multiple months to years before being discovered. Cooldowns shorter than that seem like snake oil.
Median is < 1d for major ones
We did a small survey of major incidents after shai-hulud and came to 2d cooldowns through that
If we all implement a cooldown, nobody will find the attack. This implies the cooldown length must be the cooldown length plus one month.
No, because there are malware-finding mechanisms other than "let some unlucky guy get affected first", like automated scanners. If everyone implements a cooldown, everyone will in fact be safer.
Plus some random value slow curve distribution. Basically incremental rollout from the client side. But if it's not caught at the commit time, attacker will just wait for a certain point on the curve.
You tell people that the cooldown needs to be a day, while you implement a two month cooldown.
Something something don't need to outrun the bear