Hacker News Reader

Don't get me wrong, they definitely handled this in an appropriate manner. "Better safe than sorry", but I just wonder about these sorts of situations. It reminds me of the ridiculous "SWATting" craze; wasting time and resources on something that turns out to be a false alarm. Good way to stir up a bunch of hysteria without any heavy lifting.

View on HN

That doesn't answer the question: what should they have done instead? We struggle with this at our company all the time. It's very easy to point out the shortcomings in any course of action, because these kinds of decisions almost always have trade-off. As pointed out, the alternative was to leave potentially compromised packages online. If you do a risk/outcome matrix analysis on this decision, they clearly made the right one.

Reply on news.ycombinator.com