Dependency cooldowns turn you into a free-rider(calpaterson.com)
calpaterson.com
Dependency cooldowns turn you into a free-rider
https://calpaterson.com/deps.html
3 コメント
More discussion: https://news.ycombinator.com/item?id=47773812
Let security companies drink from the firehose. Companies can pay for it and subsidize end users through Github etc. Everybody wins.
But now I find the idea of an upload quite convincing. I don't think it quite solves the free rider problem, but it does flip it. Cooldowns make security opt-in. Whereas a publish queue makes insecurity opt-in. That seems like a better default.