NPM's release cooldown is security theater • Hacker News Board

Re: NPM's release cooldown is security theater

#71

Post by outloudvi » Tue, Jul 21, 2026, 5:37 PM UTC

sublinear wrote: post #63

outloudvi wrote: post #12

Earlier quoted context omitted.

I do appreciate these security companies a lot (for example, Snyk), but I feel it hard to believe this is sustainable. Especially in the current world where LLM is devaluing security researchers' work. If they cannot get enough fiat or credit, this will eventually turn to some incident like OpenSSL heartbleed or so.

> LLM is devaluing security researchers' work I'm confused by this take. In general, LLMs don't replace the expertise required to use an LLM. Knowing the right input to give the LLM is not enough, nor does it ever end. The LLMs themselves need to be continuously updated and/or specialized for use case, and the "right input" is a moving target. Keeping both ends of this aligned is the exact same expertise we already h…

I agree that LLM does not (and believe it never) fully replace researchers, but it produces artifacts (e.g. writeups, PoCs) at a cheaper price.

That makes me think LLM impacts human researchers' rewards, but now I realized the result might actually go in the opposite direction according to Jevons paradox. People still need experienced and professional human security researchers after all.

Re: NPM's release cooldown is security theater

#72

Post by outloudvi » Tue, Jul 21, 2026, 5:45 PM UTC

woodruffw wrote: post #69

outloudvi wrote: post #65

Earlier quoted context omitted.

Thanks for your explanation on the definition of "security theater"! > But if it turns out they can’t serve as the cooldown vanguard, then we have great evidence that they shouldn’t be trusted at all. If they cannot serve as the cooldown vanguard, we are indeed going to realize they are not trustable, but by the time the damage has already been done. Therefore, if companies want to prevent the damage as much as possi…

I don’t agree about the “damage being done”: there’s no evidence that a cooldown is itself harmful. The worst thing it can do to you is deliver some updates to you slower-than-instantly.

I agree cooldown is not harmful in general. What I intended to say is that people (mostly) only know a security company is not trustable because they once failed to detect a malware package, and the reason people know a package is malware is that it has caused damaged to at least someone.

Re: NPM's release cooldown is security theater

#73

Post by hn_throwaway_99 » Tue, Jul 21, 2026, 5:54 PM UTC

pixl97 wrote: post #49

brabel wrote: post #31

Earlier quoted context omitted.

> it's absurd to think that nobody is going to pull releases before the default cool down period. Why is that absurd? It seems like a more likely outcome than just assuming there are enough "security researchers" out there doing this for every package?! IMO both sides here seem to have no evidence that the other is wrong.

Because security companies/researches are doing just that. The vast majority of recent supply chain attacks have only lasted minutes to hours. A large portion of them were credential losses or tag takeovers that aren't hard to detect, but by the time you do, your CI/CD has already downloaded and ran the attack 200 times.

Actually, you make an excellent point. Account takeovers have been responsible for a number of recent high profile attacks. Even if there are 0 security researchers reviewing new releases, just having time for the real owner to announce that a release was fraudulent before it's downloaded by half the Internet is a huge boon.

This entire article seems to say that if it doesn't prevent 100% of all possible attacks that it's "security theater". That's nonsense. It's just one more tool in the tool belt, and a highly useful one at that.

Re: NPM's release cooldown is security theater

#74

Post by sublinear » Tue, Jul 21, 2026, 6:34 PM UTC

outloudvi wrote: post #71

sublinear wrote: post #63

Earlier quoted context omitted.

> LLM is devaluing security researchers' work I'm confused by this take. In general, LLMs don't replace the expertise required to use an LLM. Knowing the right input to give the LLM is not enough, nor does it ever end. The LLMs themselves need to be continuously updated and/or specialized for use case, and the "right input" is a moving target. Keeping both ends of this aligned is the exact same expertise we already h…

I agree that LLM does not (and believe it never) fully replace researchers, but it produces artifacts (e.g. writeups, PoCs) at a cheaper price. That makes me think LLM impacts human researchers' rewards, but now I realized the result might actually go in the opposite direction according to Jevons paradox. People still need experienced and professional human security researchers after all.

Artifacts have always been delegated away by the expert when possible because expertise is more about "planning" and less about "doing".

I'm glad you brought up Jevons Paradox, because it's for this reason I believe it's an extremely poor description of what's happening with AI.

The broader topic people should be discussing is not Jevons Paradox, but marginal utility.

More artifacts have diminishing utility.

https://en.wikipedia.org/wiki/Marginal_utility

Re: NPM's release cooldown is security theater

#75

Post by hn_throwaway_99 » Tue, Jul 21, 2026, 9:16 PM UTC

Hackbraten wrote: post #40

shengpuerh wrote: post #20

Earlier quoted context omitted.

Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable.

How is that sustainable? Are security researchers going to be doing free labor for you indefinitely for exposure?

This is essentially Snyk's business model. Sure, they do upsells, but it seems fully sustainable to me.

Re: NPM's release cooldown is security theater

#76

Post by outloudvi » Wed, Jul 22, 2026, 1:44 AM UTC

hennell wrote: post #67

What a poor take. Cooldowns certainly don't solve everything but 'out of the box' even with no vetters they'll help catch unauthorised releases on active projects because it's more time to notice. Account takeovers, deployment exploits whatever the root cause, given a few days it's incredibly likely maintainers will notice they've released an unexpected update and fix/sound an alarm. A lot of existing cases like this…

Went through the comment page and found this comment that explains well on most of the popular opinions. Thank you, hennell!

Re: NPM's release cooldown is security theater

#77

Post by Quothling » Wed, Jul 22, 2026, 10:24 AM UTC

outloudvi wrote: post #66

cpburns2009 wrote: post #37

Earlier quoted context omitted.

What Godot is that? I'm only passingly familiar with the game engine.

Sorry! That's 100% on me failing to make the analogy understood. Shall have thought about that... but I'm playing too many Unity games recently.

It's not your fault that I've become unclutured. If my wife had read it she would've never thought twice about which Godot it was. Kind of fun to think about how things change though. I don't think my children will read the play in school like I did, so perhaps the game engine being named after it (I assume it is) will mean they learn about it that way?

Re: NPM's release cooldown is security theater

#78

Post by brabel » Wed, Jul 22, 2026, 10:42 AM UTC

pixl97 wrote: post #49

brabel wrote: post #31

Earlier quoted context omitted.

> it's absurd to think that nobody is going to pull releases before the default cool down period. Why is that absurd? It seems like a more likely outcome than just assuming there are enough "security researchers" out there doing this for every package?! IMO both sides here seem to have no evidence that the other is wrong.

Because security companies/researches are doing just that. The vast majority of recent supply chain attacks have only lasted minutes to hours. A large portion of them were credential losses or tag takeovers that aren't hard to detect, but by the time you do, your CI/CD has already downloaded and ran the attack 200 times.

> The vast majority of recent supply chain attacks have only lasted minutes to hours

More claims without evidence! And how are you even going to defend that claim when it’s absolutely possible that lots of attacks are not even detected?!