> Even dependency cooldown of 24h is enough to protect the consumers from these breaches.
From some of them perhaps, but plenty hide for -years- undetected.
From some of them perhaps, but plenty hide for -years- undetected.
Which ones? Not even xz-utils was years (it was weeks), and it’s the poster child for a attacker doing everything right until the very end.
(This is also different from what the GP argues.)
Not every malicious actor is a financially driven crypto-miner or credential stealer. It seems likely that some exploits are going to be sat on or used in a highly targeted manner such that we may never know they exist.
But again: it’s impossible to argue against a “silent majority” claim. The argument passes the sniff test for drug smuggling because we have separate evidence that most drugs are not interdicted. We have no such separate evidence for open source supply chain compromises.
I am aware of at least one evil firm that finds bugs like these months and sometimes years before they are public and sells the knowledge to spooks until someone else independently spots them and tells the public.
Only a matter of time before these types of firms introduce the bugs themselves given the incentives, if they are not already.
I mean okay, it probably helps in some random cases, but the disease will not care at all. Easy to route around and we just wasted a lot of developer energy treating symptoms and ignoring the actual problems.
People are running around acting like cooldowns fix supply chain attacks. This is completely absurd. Imagine an antivirus that just makes you wait one day to install any new software or updates. Should we do that too? We should question what problem are we actually solving before this type of thinking gets even more out of hand.
What we need is actually reviewing all heavily used OSS code with as many eyes and agents as possible in a coordinated and decentralized way, and then federated reproducible signed releases. If we are going to have a one day cooldown, we must do something actually useful with it or people will see it does no good and stop doing it. Without a review plan, a day might as well be a year.
Like literally fund this with taxes or something like caring for public roads. Add it to our internet bill like a utility safety fee.
It would be like having a one-day quarantine against 500k viruses, which have a median asymptomatic time of 3 hours and stdev of 1 hour: sure, statistically some get by you. But it’s dramatically better than insisting on no protection except perfect protection.