Package update cooldowns as a supply-chain defense
DavidWells · x · 2026-07-20
A practical defense against software supply-chain attacks: enforce package update cooldowns across ecosystems.
The shared resource argues that many prominent supply-chain compromises are exploited quickly but also detected quickly, and that a 3-day cooldown would have blocked most of the cited cases. The screenshot cites an analysis of ten major supply-chain attacks: eight had exploitation windows under a week, and all but one lasted under two weeks.
It also shows concrete ecosystem support, such as uv adding a built-in cooldown feature in v0.9.17, with native relative-duration syntax like uv pip install --exclude-newer '3 days' foo.
More from Infra
- AWS tutorial: fleet-wide edge CV model lifecycle with SageMaker SDK v3, ~$0.07 per run — AWS ML Blog · 2026-10-27
- Qwen3.8-27B hits 40 tok/s on Jetson Thor with INT4 + MTP, accuracy beats FP16 — No-Dragonfly6246 · 2026-10-27
- Celesto launches CI runners nearly 90% cheaper than GitHub Actions, with agent sandboxes — aniketmaurya · 2026-10-27
- Supabase founders on rebuilding the backend for a billion AI-built apps — Latent Space · 2026-10-27
- AW-0 runs at 230ms on a single RTX 5090, 2.4x faster than autoregressive code planning — trevordarrell · 2026-10-27
- Site tracks US city council topics: data centers rank only behind pickleball courts — zakkohane · 2026-10-27