I then swiped the vector embedding:

   pride is to 'honor-code' as gratitude is to reciprocity

If you have the opportunity to see it on a big screen or IMAX, it's an incredibly moving experience.

  > What they don't like is anything being forced on them

  Please don't post comments saying that HN is turning into Reddit. It's a semi-noob illusion, as old as the hills.

This mitigates things to a great extent.

I do not know who thought that having your dependencies depend on the internet with a zillion users doing stuff to each package was a good idea for enterprise environments...

It is crazy how much things can get endangered this way.

Look, I’m not an expert in drug policy. It just sounds like a logical way to reduce harm overall. The conceivable parties who would lose out are: government funded agencies charged with fighting drug crime because their caseload and budgets would probably decrease; and on the other side the cartels and dealers. Although what seems to happen with the latter is once something is legalized, the supply chains morph into legitimate businesses somehow.

I still think it would work. I’m not convinced by what you said.

I'm not saying that npm is doing everything right, but I suspect that beyond the obvious low-hanging fruit that we hear about pretty consistently with npm there's probably a long tail of less obvious stuff that can be exploited that will not be specific to npm. The fundamental problems with supply-chain vulnerabilities aren't going to go away if npm magically became pip or go modules overnight.

Why cooldowns? Most npm (or pypi) compromises were taken down within hours, cooldowns simply mean - ignore any package with release date younger than N days (1 day can work, 3 days is ok, 7 days is a bit overkill but common)

How to set them up?

- use latest pnpm, they added 1 day cooldown by default https://pnpm.io/supply-chain-security

- or if you want a one click fix, use https://depsguard.com (cli that adds cooldowns + other recommended settings to npm, pnpm, yarn, bun, uv, dependabot and renovabot)

- or use https://cooldowns.dev which is more focused on, well, cooldowns, with also a script to help set it up locally

All are open source / free.

If you know how to edit your ~/.npmrc etc, you don't really need any of them, but if you have a loved one who just needs a one click fix, these can likely save them from the next attack.

Caveat - if you need to patch a new critical CVE, you need to bypass the cooldown, but each of them have a way to do so. In the past few weeks, while I don't have hard numbers, it seems more risk has come from Software Supply Chain attacks (malicious versions pushed) than from new zero day CVEs (even in the age of Mythos driven vulnerability discovery)

Disclaimer - I maintain depsguard.

The greatest asset in this type of work is genuinely liking people, being good at what you do, and keeping in touch. My email is easily findable for a reason.