Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency cooldowns turn you into a free-rider

calpaterson.com

Post reply on HN
Print view View original

81–90 of 131 posts

Re: Dependency cooldowns turn you into a free-rider

#81

Post by p0w3n3d »

duskdozer wrote: post #78
p0w3n3d wrote: post #20

It keeps me thinking that every company loves "those guys" who create OpenSource but won't give them a broken penny, nor support them in any other way Servants! Just do your open source magic, We're impatient! Ah and thanks for all the code, our hungry hungry LLMs were starving.

As much as I think what you say in general holds, there's at least something against it here: >And the PSF even recently took in $1.5m from Anthropic for, among other things: supply-chain security.

thank you for this example. It's always heartwarming to see such case. However I have this, maybe defeatist, feeling that companies take more than they give - in general. I remember working in companies, where giving away my source code to the public would require a ton of work approval and effort, which was heavily discouraging that. On the other hand, the companies want the opensource to take care of everything...

Maybe it's only mine feeling, so I hope you guys have different experience.

Re: Dependency cooldowns turn you into a free-rider

#83

Post by mr_mitm »

bob1029 wrote: post #56

You can do this everywhere. Not just libraries. I take great pleasure in using the old 2022 LTS builds of Unity. The stability of these products is incredible compared to the latest versions. I simply have to ignore console errors in unity 6. In 2022 they are much more meaningful. Think about how much cumulative human suffering must be experienced to bring you stable and effective products like this. Why hit the rese…

Even Windows admins often wait a while after the release of an update so they don't get a bad update from Microsoft, which is a real concern unfortunately.

Re: Dependency cooldowns turn you into a free-rider

#85

Post by collabs »

I agree a hundred percent with the authors. We have worked hard to get us where we are today where there is pressure for companies to update their packages. This so called cool down backslides us from it.

Here is one example

https://www.nuget.org/packages/System.CommandLine#versions-b...

2.0.6 was released less than a day ago. How long will you wait? I'd argue any wait is unwarranted.

It sounds nice to people because we are used to thinking in terms of Microsoft Windows and Microsoft SQL Server releases where people wait for months after a new version is released to update. Except companies actually pay for these! So somehow this kind of illogical action or I would argue learned helplessness that happens with flagship Microsoft product releases is what we are now advocating as the default everywhere which is a terrible idea.

Dependency cooldowns should NOT be the default. I don't know what a proper solution is but I know this isn't it.

Re: Dependency cooldowns turn you into a free-rider

#87

Post by zarzavat »

This is not true. Attackers are usually not publishing packages under their own accounts. They are publishing packages using hacked accounts of major packages that have many dependants.

The real owner will (hopefully) notice when a malicious version is published.

If you use a cooldown then it gives the real owner of the account enough time to report the hack and get the malicious version taken down.

Re: Dependency cooldowns turn you into a free-rider

#89

Post by hunterpayne »

This wouldn't stop a lot of supply chain attacks. Attacks aren't identified immediately. Often they are only identified months later. And in that period, plenty of zero days are fixed. So this technique not only doesn't fix the problem, it introduces others. Also, again, this only happens to Python because of design flaws in the package managers themselves. Fix the package managers and this all goes away.

Re: Dependency cooldowns turn you into a free-rider

#90

Post by pabs3 »

BlackFly wrote: post #41

I think what you actually want is audit sharing as the cooldown period. No audit shared with the community yet? The package is still in cooldown. Or you can risk it and run unaudited dependencies or audit it yourself and potentially share that. It seems to me that many organizations are relying on other companies to do their auditing in any case, why not just admit that and explicitly rely on that? Choose who you tru…

I prefer crev-dev for the review sharing thing:

https://github.com/crev-dev/

Post reply on HN