2026-06-06 09:46 UTC
@anze3db@fosstodon.org I read this post a few weeks ago, and thought: that makes sense!
But now I was seeing this graph, and learned that there is less than 24 hours between when a vulnerability is found and when it is exploited. Now I am wondering what the correct cooldown strategy should be. Any thoughts on that?
Replies (1)
-
@anze3db@fosstodon.org 2026-06-06 12:05
@erwinrossen@mas.to good point. I think the cooldown period works for regular updates but not for security updates. If you are impacted by a security vuln you should upgrade immediately. That's not something you can easily automate though... What you can do is set a lower cooldown period for packages you trust more. E.g. we have a general 3 day cooldown for all packages but 1 day for Django so that we bring in security updates the same week. We would patch immediately if the CVE was impacting us.