Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency cooldowns turn you into a free-rider

calpaterson.com

Post reply on HN
Print view View original

61–70 of 131 posts

Re: Dependency cooldowns turn you into a free-rider

#61

Post by swiftcoder »

dingdongditchme wrote: post #54

Having skimmed the article I understand the title. While I agree on some level I wholly disagree on another: to me "dependency cooldown" is a way to automate something as old as time: the late-adopter-laggard. Although I am a tech-nerd and like the latest stuff. I have almost always let other people try it out first. I've missed out on some things because of it but if you are more conservative in your actions it just…

The problem is making it a default (or even popular). If everyone tries to move themselves later in the chain, you just moved detection later in the chain as well

Re: Dependency cooldowns turn you into a free-rider

#62

Post by Zababa »

riknos314 wrote: post #25
dominicq wrote: post #18

> Fundamental in the dependency cooldown plan is the hope that other people - those who weren't smart enough to configure a cooldown - serve as unpaid, inadvertent beta testers for newly released packages. This is wrong to an extent. This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automated scanners for popular and less popular libraries, w…

Sure, but the alternative the author proposes not only allows for time for those scanners to run but explicitly models that time as a formal part of the release process . Status quo (at least in most language's package managers) + cooldowns basically means that running those checks happens in parallel with the new version becoming the implicit default version shipped to the public. Isn't it better to run the safety a…

>Sure, but the alternative the author proposes not only allows for time for those scanners to run but explicitly models that time as a formal part of the release process.

This is true but that doesn't make "Dependency cooldowns turn you into a free-rider", the title of the article and the subject of the first part, true.

Re: Dependency cooldowns turn you into a free-rider

#63

Post by JR1427 »

A central package cooldown is not really any different to individual cooldowns.

The main reason for the cooldown is so security companies can find the issues, not that unwitting victims will find them.

One problem of the central cooldown is that it restricts the choice to be able to consume a package immediately, and some people might think that a problem.

Re: Dependency cooldowns turn you into a free-rider

#64

Post by snthpy »

I feel that the title burries the lead and a positive one would be better:

Upload queues are better than cooldowns

I almost didn't read it because I wasn't interested in a rant. This is a genuinely good idea though so I'm glad I did.

Alas, I did click through so perhaps the title is more effective than my sentiments.

Re: Dependency cooldowns turn you into a free-rider

#65

Post by absynth »

I don't think queues like this are a panacea but they are a good idea. They buy time. That's the whole point. Time to respond. Time for a paper trail. Time to investigate. Time to cancel.

Have a normal path, eg days, a week or more (a month!). Have a selection of fast paths. Much shorter time. Days or even hours. Exceptions require higher trust. Indicators like money / reputation / history could be useful signals even if its only part of a paper trail. Treat exceptions as acceptable but requiring good reasons and explanation. This means a CVE fix from someone with high reputation could go through faster. While exceptions don't reduce the need for scrutiny they do enable clarity about the alternative chosen. Mainly because someone had to justify it away from the normal path. That's valuable in itself.

There's no perfection here. Credit cards and credentials get stolen. Reputation drifts since people change for all kinds of reasons.

Queues buy time. Time to find out. Time to back out.

Re: Dependency cooldowns turn you into a free-rider

#66

Post by Cthulhu_ »

JR1427 wrote: post #63

A central package cooldown is not really any different to individual cooldowns. The main reason for the cooldown is so security companies can find the issues, not that unwitting victims will find them. One problem of the central cooldown is that it restricts the choice to be able to consume a package immediately, and some people might think that a problem.

I can't help but wonder why security reviews aren't standard practice. Surely enterprises would be willing to pay for that? You get the default releases as they are today, then a second line that get a "security reviewed" certification released at most a few weeks later.

Of course the problem there is that security audits are fallible. Some issues are so subtle that they are only revealed years after they're introduced, despite them being open source and subject to potentially all the tools and eyes.

Re: Dependency cooldowns turn you into a free-rider

#67

Post by antonvs »

asdfasgasdgasdg wrote: post #14
antonvs wrote: post #3

Mature professionals and organizations have always waited to install updated dependencies in production, with exceptions for severe security issues such as zero day attacks. "Free riding" is not the right term here. It's more a case of being the angels in the saying "fools rush in where angels fear to tread". If the industry as a whole were mature (in the sense of responsibility, not age), upgrades would be tested in…

I think the appeal to the categorical imperative is very interesting though. Someone needs to try it. If everyone were wise as you term it, then it's essentially a stalemate while you wait for someone else to blink first and update. Then again, there are other areas where I feel that Kantian ethics also fail on collective action problems. The use of index funds for example can be argued against on the same line as we…

> it's essentially a stalemate while you wait for someone else to blink first and update.

I addressed that in my comment, and you essentially repeated that point:

> I wonder if this argument fails because it ignores that there are a diversity of preferences.

The stalemate you described is only an issue if everyone is in the same circumstances and operating under the same criteria, but reality is very far from that situation.

Re: Dependency cooldowns turn you into a free-rider

#68

Post by nkrisc »

While an upload queue does sound like a better solution overall, the suggestion of cooldowns as immoral is absurd.

Ever decided to not buy some new technology or video game or product right away and to wait and see if it’s worth it? You’re an immoral freeloader benefiting from the suffering of others who bought it right away.

Re: Dependency cooldowns turn you into a free-rider

#69

Post by zmmmmm »

Curious what happens in the context of a security flaw becoming known with a queue, especially with the whole dependency tree in play. Do we now wait for the fix to come through the queue? Or it gets an exception? Do packages that embed the flawed library have to wait for the fix to merge (through whatever path) before they can depend on it? Or does the exception cascade out to the entire ecosystem that depends on the flawed package?
Post reply on HN