Hacker News Reader

If we all implement a cooldown, nobody will find the attack. This implies the cooldown length must be the cooldown length plus one month.

No, because there are malware-finding mechanisms other than "let some unlucky guy get affected first", like automated scanners. If everyone implements a cooldown, everyone will in fact be safer.

Plus some random value slow curve distribution. Basically incremental rollout from the client side. But if it's not caught at the commit time, attacker will just wait for a certain point on the curve.

You tell people that the cooldown needs to be a day, while you implement a two month cooldown.

Something something don't need to outrun the bear

My research did not show “months to years.” Even weeks of presence are an outlying event[1].

(This is a situation where everybody benefits from high quality data. If you have data that contradicts mine, please share it!)

[1]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

Median is < 1d for major ones

We did a small survey of major incidents after shai-hulud and came to 2d cooldowns through that