Comment by abhisek
5 hours ago
What are you talking about? Even dependency cooldown of 24h is enough to protect the consumers from these breaches. The attack did not have any novelty, used a newly registered look-alike domain for C2 and a PTH technique which is now known.
Sandbox comes in for the unknown ones and yes, its a pain to get the profile right.
> Even dependency cooldown of 24h is enough to protect the consumers from these breaches.
From some of them perhaps, but plenty hide for -years- undetected.
Don't let perfect be the enemy of good
It would be like having a one day quarantine for a deadly and rapidly spreading disease known to have a very long asymptomatic period.
I mean okay, it probably helps in some random cases, but the disease will not care at all. Easy to route around and we just wasted a lot of developer energy treating symptoms and ignoring the actual problems.
People are running around acting like cooldowns fix supply chain attacks. This is completely absurd. Imagine an antivirus that just makes you wait one day to install any new software or updates. Should we do that too? We should question what problem are we actually solving before this type of thinking gets even more out of hand.
What we need is actually reviewing all heavily used OSS code with as many eyes and agents as possible in a coordinated and decentralized way, and then federated reproducible signed releases. If we are going to have a one day cooldown, we must do something actually useful with it or people will see it does no good and stop doing it. Without a review plan, a day might as well be a year.
Like literally fund this with taxes or something like caring for public roads. Add it to our internet bill like a utility safety fee.
1 reply →