Last week, the continuous integration pipeline I set up failed because a package that I had locked three weeks ago was no longer resolving in the same manner on my local machine. The solution? Just wait for 72 hours. Because that seems to be the approach to security these days. 🙄 The new gospel of waiting Security teams think they have found the answer to supply-chain attacks: Time. Here's a simple suggestion: don't install a package as soon as it's released. Wait 72 hours so tha...