Dependency cooldowns are essentially security measures that rely on the hope that someone else gets hacked first.
A better approach would be to introduce upload queues at package indexes, separating "published" from "distributed" so that scanners and maintainers have time to review releases and everyone is protected by default.
Interesting post by @cal_paterson https://t.co/MZil3fe7MV
@wasabi_protocol drained $4.5M, looks like an admin key compromise. Another reminder that multisig on the README means nothing if the signers and thresholds aren't actually decentralized.
If you've followed RareSkills NTT thread, the inverse is the half that actually makes polynomial multiplication usable. Worth a read for anyone going deep on ZK.
https://t.co/npUBuVk41X
Move's type system kills whole bug classes Solidity devs sweat over, no silent drops, no dynamic dispatch hijacks, ownership enforced at both type and runtime layers. But novel guarantees breed novel footguns. Sharp writeup on what still bites in real Sui audits.
https://t.co/unOTj81tPQ
Firefox patched 271 bugs surfaced by Claude Mythos preview and Mozilla notes none were beyond what a top human researcher could find. The interesting number isn't 271, it's how fast one model burned through that backlog.
https://t.co/1wDGZhoaSf
@trailofbits@dguido Serious question, how will you sustain expertise over time? The setup you presented seems short-sighted, as it largely focuses on exploiting existing knowledge and not developing it.
A security council freezing 30k ETH mid-exploit is the quiet admission that L2s aren't trust-minimized yet, they're trust-delegated to a multisig fast enough to push the pause button. Useful today, awkward for the decentralization pitch tomorrow.
https://t.co/wdEoQjrFXl
@DevDacian 100% agree, but we shouldn't focus on a single party to blame. @LayerZero_Core's DVN got compromised, @KelpDAO used only one DVN, and @aave failed at due diligence. Imho, all three should cover the losses and prepare a recovery plan, otherwise, it's over for DeFi.