Growing convinced we could and should ship new version cooldown in the Go modules ecosystem.

[filippo@abyssdomain.expert]

Growing convinced we could and should ship new version cooldown in the Go modules ecosystem.

The subdb and MVP get us far, and supply chain attacks are not much of a thing in Go beyond typosquatting, but we want to stay ahead of them.

https://github.com/golang/go/issues/76485#issuecomment-4043378459

[cks@mastodon.social]

@filippo My experience is that I've seen multiple cases where dependabot updates raced with the dependency re-publishing a different thing under the same tag. The result was something that would only build if you used the proxy (which had cached the original published version). This is obviously bad practice (possibly in multiple places), but I think it suggests a cooldown would be useful even with MVP.

(Also maybe dependabot needs a cooldown itself, but ... good luck persuading them.)

[markd@hachyderm.io]

@filippo If cooldown becomes common would that mean that supply chain attacks would mostly affect early adopters who presumably are more sensitive to the risks?

[drwho@masto.hackers.town]

@filippo But then coders will go back to node.js!