Hacker News Reader

Comment by stbenjam | Hacker News Reader

IMHO defaults for uv, npm, etc should all have a cooldown for 24 - 48 hours by default, you should have to go out of your way to install something newer.

View on HN

We have 7d cooldown on packages on an internal pypi proxy but that blocks security updates also, which we now have to manually exclude from the cooldown.

I’m unsure how to automate this properly, maybe an LLM is the best starting point.

Are security updates immune ?

It’s in the name. They are secure!

No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature.

But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.

We need something external that actually checks to see if source code matches built artifacts, and also possibly something Llm based that checks to see if you’re making checked in code vulnerable or directly adding something malicious.

Ask your LLM about "reproducible builds".

Yeah those exist… the trouble being we need something that doesn’t exist

There needs to be a service that does reproducible builds of opensource projects as they sit and publishes results for people to scrape freely.

To be robust itself against attacks, likely 3-4 services.

But then that needs funding to be sustainable … and companies are incredibly cheap. Especially right now. As such… shrug :(

Maybe something as a skill for LLMs to run that actually checks build reproduction from source for a project and all of its dependencies? But then that’s gonna burn some tokens ….

I do this for personal projects … but at work they’ve started rationing tokens… as such… idk?

They definitely wouldn't be if attackers knew that it would then bypass cooldowns!

Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.

Problem is, we leave ourselves open for LLM injection attacks.

I use safechain for this, because there is always gonna be another package manager configured wrong. https://github.com/AikidoSec/safe-chain

It's just next level:

"Installing the Aikido Safe Chain is easy with the installation script.

curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.... -o /tmp/install-safe-chain.sh \ && echo "9e4af7107f06d9c0d758cb08fb36804c2af88e24972f3a9d3f8c2bd0ca002adf /tmp/install-safe-chain.sh" | sha256sum -c - \ && sh /tmp/install-safe-chain.sh \ && rm /tmp/install-safe-chain.sh "

(facepalm)

I didn't realize they've all such added that, this was a change we made to our own projects last year when these first started - glad to see it's common.

Risk is ensuring enough security researchers are finding these and quarantining these before that default cooldown lapses.

Yea, I think all the tools have this now but its not a default. Install scripts should also be turned off by default and require some hassle to turn them on for the first time in a package.

The last time I looked for information, I remember seeing that the median supply chain attack was in place for multiple months to years before being discovered. Cooldowns shorter than that seem like snake oil.

If we all implement a cooldown, nobody will find the attack. This implies the cooldown length must be the cooldown length plus one month.

You tell people that the cooldown needs to be a day, while you implement a two month cooldown.

Something something don't need to outrun the bear

Plus some random value slow curve distribution. Basically incremental rollout from the client side. But if it's not caught at the commit time, attacker will just wait for a certain point on the curve.

No, because there are malware-finding mechanisms other than "let some unlucky guy get affected first", like automated scanners. If everyone implements a cooldown, everyone will in fact be safer.

Median is < 1d for major ones

We did a small survey of major incidents after shai-hulud and came to 2d cooldowns through that

My research did not show “months to years.” Even weeks of presence are an outlying event[1].

(This is a situation where everybody benefits from high quality data. If you have data that contradicts mine, please share it!)

[1]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

I wonder if in some cases it's not so much that people are updating too quickly, but rather, their deployment pipelines do not have pinned / frozen versions attached to their builds.

I’d imagine there were probably fixes for critical CVEs that were included …. A lot of companies are on a 24 hour timeline to get them out.

Then we’ll find out about malware 24 - 48 hours later.

Reply on news.ycombinator.com