[weinzierl]

If it is about a few highly specialized firms finding the vulns we should let them do it before publication and we do not need cooldowns.

If it is not about that and we still subscribe to Linus's law then cooldowns will just postpone the problem.

[StrauXX]

Publishing publicly then applying cooldowns in projects is much easier tgan establishing a new standard for pre-release security testing versions that works across ecosystems and gains zooling support.

[yuppiepuppie]

Exactly this. The firms can follow the standard practices of the industry without needing to injection further process into the projects.

[weinzierl]

Releasing secure software is the right thing to do. We only release insecure software because we need the eyeballs to make it secure.

If we believe the point made above that the many eyeballs are not that important then releasing before we have done everything to make the software as secure as possible is irresponsible.

[palky]

"We only release insecure software because we need the eyeballs to make it secure." No one is doing this on purpose, they believe the software to be secure when they release it... You shouldn't gate the release of a package until every single offsec research shop in the world has had a chance to look at it

[rcxdude]

The cooldowns effectively make the initial push into the package repository into a pre-publishing step. It's pretty much isomorphic with what you're suggesting.