Maybe you shouldn't install new software for a bit | Hacker News

Hacker News commenters discussed using update delays and cooldown periods to reduce software supply-chain risk.

They argued for tighter control over package installs, dependency fetching, and approved artifacts instead of auto-pulling the newest versions.

Suggestions included pinning build images, limiting registry access in CI, and avoiding “latest” tags by default.

The broader point was that stricter update pipelines can help blunt supply-chain attacks without blocking security fixes entirely.