Package Managers Need to Cool Down

8 points by JamieTanna

If everyone impl. cooldown feature then it will be basically the same as now but delayed by cooldown period. Software/package user cannon fodders are needed for frontier live testing.

Relax
There are still cases where it helps:
1. A developer is compromised and a malicious package is published. Even if the developer is immediately aware of the situation, it's a race to contact the package manager authority and get it taken down before anyone uses it.
2. There are researchers and other professionals that monitor package repos and try to detect this sort of thing. Giving them some lead time would definitely help.
chilton

I think the author is recommending an default setting that can be overridden. Organizations that need to be on the bleeding edge can override the default and get packages immediately. Regular consumers would wait one week.

ondreian

Seems like a simple, elegant solution to a complex problem. I haven't really looked, but I imagine you can broadly override the cooldown in times of crisis? Let's say a package goes live after cooldown that breaks stuff downstream somehow, shipping the patch behind a cooldown would be problematic from the gems.coop level... but seems like a lot saner default than the current hellscape.