We should all be using dependency cooldowns • Hacker News Board

Re: We should all be using dependency cooldowns

#101

Post by justsomehnguy » Fri, Nov 21, 2025, 7:14 PM UTC

layer8 wrote: post #20

People in this thread are worried that they are significantly vulnerable if they don't update right away. However, this is mostly not an issue in practice. A lot of software doesn't have continuous deployment, but instead has customer-side deployment of new releases, which follow a slower rhythm of several weeks or months, barring emergencies. They are fine. Most vulnerabilities that aren't supply-chain attacks are o…

> People in this thread are worried that they are significantly vulnerable if they don't update right away

Most of them assume what if they are working on some public accessible website then 99% of the people and orgs in the world are running nothing but some public accessible website.

Re: We should all be using dependency cooldowns

#102

Post by woodruffw » Fri, Nov 21, 2025, 7:14 PM UTC

jcalvinowens wrote: post #93

woodruffw wrote: post #82

Earlier quoted context omitted.

I think this is an overly tendentious reading. Nobody else seems to have gotten hung up on this, because they understand that it's a policy, not an immutable law of nature. The argument advanced in the post is IMO clear: cooldowns are a sensible default to have, and empirically seem to be effective at mitigating the risk of compromised dependencies. I thought I took sufficient pains to be clear that they're not a pan…

I'm simply saying I think the policy you're proposing is bad. It is completely bizarre to me you're trying to frame that as a semantic argument.

I'm not saying it's a semantic argument. I'm saying that the policy isn't universal, whereas your argument appears to hinge on me thinking that it is. But this seems to have run its course.

Re: We should all be using dependency cooldowns

#103

Post by jcalvinowens » Fri, Nov 21, 2025, 7:20 PM UTC

woodruffw wrote: post #102

jcalvinowens wrote: post #93

Earlier quoted context omitted.

I'm simply saying I think the policy you're proposing is bad. It is completely bizarre to me you're trying to frame that as a semantic argument.

I'm not saying it's a semantic argument. I'm saying that the policy isn't universal, whereas your argument appears to hinge on me thinking that it is. But this seems to have run its course.

That's a semantic argument.

Me saying your proposed policy is bad is in no way predicated on any assumption you intended it to be "universal". Quite the opposite: the last thing anybody needs at work is yet another poorly justified bullshit policy they have to constantly request an "exception" to to do their job...

Re: We should all be using dependency cooldowns

#104

Post by OhMeadhbh » Fri, Nov 21, 2025, 7:30 PM UTC

I'm not arguing that cooldowns are a bad idea. But I will argue that the article presents a simplified version of user behaviour. One of the reasons people upgrade their dependencies is to get bug fixes and feature enhancements. So there may be significant pressure to upgrade as soon as the fix is available, cooldowns be damned!

If you tell people that cooldowns are a type of test and that until the package exits the testing period, it's not "certified" [*] for production use, that might help with some organizations. Or rather, would give developers an excuse for why they didn't apply the tip of a dependency's dev tree to their PROD.

So... not complaining about cooldowns, just suggesting some verbiage around them to help contextualize the suitability of packages in the cooldown state for use in production. There are, unfortunately, several mid-level managers who are under pressure to close Jira tickets IN THIS SPRINT and will lean on the devs to cut whichever corners need to be cut to make it happen.

[*] for some suitable definition of the word "CERTIFIED."

Re: We should all be using dependency cooldowns

#105

Post by marcosdumay » Fri, Nov 21, 2025, 7:32 PM UTC

nitwit005 wrote: post #96

theoldgreybeard wrote: post #16

jokes on them I already have 10 year dependency cooldowns on the app I work on at work!

This did make me think of our app running on Java 8. Although, I suppose we've probably updated the patch version.

There's always the one that requires Java 8, and the one that requires Java >= 11.

Re: We should all be using dependency cooldowns

#106

Post by jcalvinowens » Fri, Nov 21, 2025, 7:33 PM UTC

saurik wrote: post #87

jcalvinowens wrote: post #53

Earlier quoted context omitted.

Zero days often get fixed sooner than seven days. If you wait seven days, you're pointlessly vulnerable.

Only if you already upgraded to the one with the bug in it, and then only if you ignore "this patch is actually different: read this notice and deploy it immediately". The argument is not "never update quickly": it is don't routinely deploy updates constantly that are not known to be high priority fixes.

> The argument is not "never update quickly": it is don't routinely deploy updates constantly that are not known to be high priority fixes.

Yes. I'm saying that's wrong.

The default should always be to upgrade to new upstream releases immediately. Only in exceptional cases should things be held back.

Re: We should all be using dependency cooldowns

#107

Post by lock1 » Fri, Nov 21, 2025, 7:33 PM UTC

dap wrote: post #86

embedding-shape wrote: post #46

Earlier quoted context omitted.

> for critical vulnerabilities to assess whether your product is affect by it. Only then do you need to update that specific dependency right away. This is indeed what's missing from the ecosystem at large. People seem to be under the impression that if a new release of software/library/OS/application is released, you need to move to it today. They don't seem to actually look through the changes, only doing that if a…

At my last job, we only updated dependencies when there was a compelling reason. It was awful. What would happen from time to time was that an important reason did come up, but the team was now many releases behind. Whoever was unlucky enough to sign up for the project that needed the updated dependency now had to do all those updates of the dependency, including figuring out how they affected a bunch of software tha…

I think it also depends on the community as well. Last time I touched Node.js and Javascript-related things, every time I tried to update something, it practically guaranteed something would explode for no reason.

While my recent legacy Java project migration from JDK 8 -> 21 & a ton of dependency upgrades has been a pretty smooth experience so far.

Re: We should all be using dependency cooldowns

#108

Post by nine_k » Fri, Nov 21, 2025, 7:48 PM UTC

OhMeadhbh wrote: post #104

I'm not arguing that cooldowns are a bad idea. But I will argue that the article presents a simplified version of user behaviour. One of the reasons people upgrade their dependencies is to get bug fixes and feature enhancements. So there may be significant pressure to upgrade as soon as the fix is available, cooldowns be damned! If you tell people that cooldowns are a type of test and that until the package exits the…

There is a difference between doing

  $ npm i
  78 packages upgraded

and upgrading just one dependency from 3.7.2_1 to 3.7.2_2, after carefully looking at the code of the bugfix.

The cooldown approach makes the automatic upgrades of the former kind much safer, while allowing for the latter approach when (hopefully rarely) you actually need a fix ASAP.

Re: We should all be using dependency cooldowns

#109

Post by dugidugout » Fri, Nov 21, 2025, 7:50 PM UTC

layer8 wrote: post #38

perlgeek wrote: post #26

Some scattered thoughts on that: * If everybody does it, it won't work so well * I've seen cases where folks pinned their dependencies, and then used "npm install" instead of "npm ci", so the pinning was worthless. Guess they are the accidental, free beta testers for the rest of us. * In some ecosystems, distributions (such as Debian) does both additional QA, and also apply a cooldown. Now we try to retrofit some of…

"If everybody does it, " is rarely a good argument, because the premise rarely becomes reality.

If you're prescribing a public practice you intend to be taken seriously, you should contend with what happens at scale, especially when evaluating competing alternatives, where comparative scale effects become decisive. Given the article's push for ecosystem-wide support, there's good reason to probe this hypothetical.

Re: We should all be using dependency cooldowns

#110

Post by andrewla » Fri, Nov 21, 2025, 7:55 PM UTC

I'm not convinced that this added latency will help, especially if everyone uses it. It may protect you as long as nobody else uses a cooldown period, but once everyone uses one then the window between the vulnerability being introduced and it being detected will expand by a similar amount, because without exposure it is less likely to be found.