Cooldown is merely a type of flighting. Specifically, picking a flight beyond canary.
Dependency cooldowns turn you into a free-rider
11–20 of 131 posts
Re: Dependency cooldowns turn you into a free-rider
#12It's open source. Free riding is expected and normal. We all benefit from the work of others.
If you're not doing the work yourself, it makes sense to give the people who review and test their dependencies some time to do their work.
Re: Dependency cooldowns turn you into a free-rider
#13This doesn’t solve the problem either, which is that of the Confused Deputy [1]. An arbitrary piece of code I’m downloading shouldn’t be able to run as Ryan by default with access to everything Ryan has.
We need to revitalize research into capabilities-based security on consumer OSs, which AFAIK is the only thing that solves this problem. (Web browsers - literally user “agents” - solve this problem with capabilities too: webapps get explicit access to resources, no ambient authority to files, etc.)
Solving this problem will only become more pressing as we have more agents acting on our behalf.
Re: Dependency cooldowns turn you into a free-rider
#14Mature professionals and organizations have always waited to install updated dependencies in production, with exceptions for severe security issues such as zero day attacks. "Free riding" is not the right term here. It's more a case of being the angels in the saying "fools rush in where angels fear to tread". If the industry as a whole were mature (in the sense of responsibility, not age), upgrades would be tested in…
I think the appeal to the categorical imperative is very interesting though. Someone needs to try it. If everyone were wise as you term it, then it's essentially a stalemate while you wait for someone else to blink first and update.
Then again, there are other areas where I feel that Kantian ethics also fail on collective action problems. The use of index funds for example can be argued against on the same line as we argue against waiting to update. (That is, if literally everyone uses index funds then price discovery stops working.) I wonder if this argument fails because it ignores that there are a diversity of preferences. Some organizations might be more risk averse, some less so. Maybe that's the only observation that needs to be made to defeat the argument.
Re: Dependency cooldowns turn you into a free-rider
#15> Dependency cooldowns turn you into a free-rider
Avg tech company: "that's perfect, we love to be free riders."
Re: Dependency cooldowns turn you into a free-rider
#16Okay sure, but what happens when a high CVE is discovered that requires immediate patching – does that get around the Upload Queue? If so, it's possible one could opportunistically co-author the patch and shuttle in a vulnerability, circumventing the Upload Queue. If you instead decide that the Upload Queue can't be circumvented, now you're increasing the duration a patch for a CVE is visible. Even if the CVE disclos…
This literal example is actually addressed by the Debian example - the security team has powers to shuttle critical CVEs through but it’s a manual review process.
There’s a bunch of other improvements they call out like automated scanners before distribution and exactly what changed between two distributed versions.
The only oversight I think in the proposal is staggered distributions so that projects declare a UUID and the distribution queue progressively makes it available rather than all or nothing
Re: Dependency cooldowns turn you into a free-rider
#17Not everyone has the same update cycle. That's not free-riding. The framing around not being on the latest version as irresponsible doesn't hold up.
Re: Dependency cooldowns turn you into a free-rider
#18> Fundamental in the dependency cooldown plan is the hope that other people - those who weren't smart enough to configure a cooldown - serve as unpaid, inadvertent beta testers for newly released packages.
This is wrong to an extent.
This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automated scanners for popular and less popular libraries, with manual triggers for those libraries which are not in the top N.
Their incentive is to be the first to publish a blog post about a cool new attack that they discovered and that their solution can prevent.
Re: Dependency cooldowns turn you into a free-rider
#19I just feel like this problem is something where unfettered capitalism does not work. What we are discussing here is a public utility, and should be managed as such
Re: Dependency cooldowns turn you into a free-rider
#20It keeps me thinking that every company loves "those guys" who create OpenSource but won't give them a broken penny, nor support them in any other way
Servants! Just do your open source magic, We're impatient! Ah and thanks for all the code, our hungry hungry LLMs were starving.