Somebody goes first

Three days. That is the window Rust 1.100 uses to demonstrate `global-min-publish-age`, the Cargo setting it stabilized Thursday. Put it in `.cargo/config.toml` and Cargo skips any crate version younger than the window, then tells you what it held back: cc 1.18.0, published three hours ago; clap 4.6.9, two days old. The release drew 737 points on Hacker News, and the feature deserved the attention. The Rust team's case for it fits in one sentence:

The setting is sound, and Rust is following rather than leading here; pnpm has its own `minimumReleaseAge`. But read that sentence again for who does the catching. A cooldown detects nothing. It waits while someone else detects. Part of that someone is a scanner. The rest is "the community" — in practice, the developers who ran `cargo update` on day one, built the bad version, and noticed something wrong.

That makes a dependency cooldown an odd kind of defense: it works best while few people use it. Each project that sets three days leaves the group that finds a malicious release and joins the group that benefits from its being found. The choice is rational for every individual shop. Made by all of them, it thins out the population it depends on.

A cooldown detects nothing. It waits while someone else detects.

The "hours or days" in Rust's sentence describes an ecosystem where most people took new versions as soon as they appeared. Push cooldowns far enough and the first-day population becomes hobby projects, CI running on defaults, and the attacker checking their own work. The bad release still gets caught, by whoever is left. It takes longer, and the window you configured was sized for the old speed.

The strongest objection is that scanners don't need a canary. They read every release the moment it lands, and they keep getting better. For the attacks they catch, a universal cooldown costs nothing. Grant that. The attacks that matter are the ones that slip past them, and those are caught by people — the part a cooldown erodes. The Rust team says as much: cooldowns, its notes concede, "are not a complete defense on their own." The next step in its supply-chain hardening goal is "quarantine support and automated detection of suspicious releases."

Quarantine is the right direction, because it moves the wait from the user to the registry. A cooldown you set protects you. A quarantine protects the developer who never heard of the setting, and it doesn't need anyone to go first. Until crates.io holds the door, set your three days, and know whose first day you're counting on.