Kessler is much less of a problem at their altitude (480km). Debris has too much drag and would get pulled down too quick to have a sustained Kessler situation. It's possible, but very very unlikely at that altitude.
You could still generate a mess for 5-10 years at that altitude. Even if it self-clears you still destroy the constellation and deny access to LEO for years.
Even if everyone used it, the security scanners would still have time to do their static analysis of new packages. Basically, all the clients implementing a delay would create a de facto quarantine status for new packages so they can be examined before everyone starts installing them. (Why npm doesn't just implement that themselves, I do not know.)
I think if they did it, then attackers would be able to iterate their attack against their own project, and once it passes the filters they could deploy for real.
I guess it could work better if it was enabled for only actual attack vectors projects.
That’s my point. For whatever reason, npm isn’t doing it. All npm users adding a minimum package age is kind of like doing it as a collective, without npm’s help.
reply