Hacker News Reader

> If everyone sets a cooldown, there will be no early adopter.

This ignores all the security companies & researchers screening packages.

Also ignores the common vector of the maintainer getting compromised and their credentials immediately being used to push malware.

Most maintainer are going to notice that themselves.

Exactly, and the vast majority of the attack success is in a very short period of time.

It will make credential attacks much harder to pull off successfully and the returns from using them will drop pretty dramatically.

Isn't this what alpha/beta/RC releases are for, ensuring that there are no issues before a general release? I just don't get ecosystem has decided to use client-side configurations for this rather than just marking the releases in the ways that already exist.

When the attacker gets your npm/gh credentials they just publish a new 'full' release making your idea worthless.

If it helps, think of cooldown periods as a way to do staged rollouts.

Reply on news.ycombinator.com