If I had to bet, the most likely and pragmatic solution will be to have dependen... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		jimbohn 15 days ago \| parent \| context \| favorite \| on: Shai-Hulud Returns: Over 300 NPM Packages Infected If I had to bet, the most likely and pragmatic solution will be to have dependencies cooldown and that's it

creata 15 days ago [–]

If everyone does it, then it becomes less effective, because there'd be fewer early testers to experience and report issues, no?

jimbohn 15 days ago | [–]

Yes, it's gonna be heuristics all way down. This problem isn't solved formally but the ecosystem(s) having these issues are too big to be discarded "just" because of that.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact