Hacker News Reader

Comment by weinzierl | Hacker News Reader

If it is about a few highly specialized firms finding the vulns we should let them do it before publication and we do not need cooldowns.

If it is not about that and we still subscribe to Linus's law then cooldowns will just postpone the problem.

View on HN

Publishing publicly then applying cooldowns in projects is much easier tgan establishing a new standard for pre-release security testing versions that works across ecosystems and gains zooling support.

Exactly this. The firms can follow the standard practices of the industry without needing to injection further process into the projects.

Releasing secure software is the right thing to do. We only release insecure software because we need the eyeballs to make it secure.

If we believe the point made above that the many eyeballs are not that important then releasing before we have done everything to make the software as secure as possible is irresponsible.

"We only release insecure software because we need the eyeballs to make it secure." No one is doing this on purpose, they believe the software to be secure when they release it... You shouldn't gate the release of a package until every single offsec research shop in the world has had a chance to look at it

The cooldowns effectively make the initial push into the package repository into a pre-publishing step. It's pretty much isomorphic with what you're suggesting.

Reply on news.ycombinator.com