Post #1343817
2026-03-25 23:12 UTC
@rradczewski yeah, I'm really distraught about this. I want new packages as soon as possible to get fixes but I also don't want to get caught out by the impostor attacks.
30 days sound already quite dangerous in the other direction
Replies (1)
-
@rradczewski@hachyderm.io 2026-03-26 07:15
@jay_peper yeah, for trunkver, we do 30 days except vulnerability updates. At the same time, the whole "quick! Update or you get hacked!" is the textbook urgency that attackers would want to exploit. And, honestly I want it everywhere. I want it as a hook in my package managers for projects, pinned vscode extensions, flatpaks, anything where a diff isn't validated by a third party before pushing an update to my system. (https://github.com/crftd-tech/trunkver/blob/15a500b2c1b6ab9acf6b1a3af74c3b2de64fed0b/renovate.json#L10-L13)