[SideburnsOfDoom]

> And if every malware developer worth their salt now introduces code to "wait out" that period of time, we're back to square one.

Of course this is an arms race, but the time setting inside the sandbox doesn't need to be the same as outside.

[tharkun__]

That's a fair enough thing to say but then also setting the default to 7 days is no longer a necessity, because security researchers can automate running a new version through an accelerated time sandbox, can't they?

And no they can't and is probably why this change is happening to dependabot: A common pattern is sampling time before and after a sleep/timer, then aborting/delaying if the sandbox looks like it accelerated time by having a 1s sleep timer expire after 0.1s. Malware would also try to use different time sources and try to correlate them.

And yeah, like you say as well, of course its an arms race in the same way that back in the day state of the art viruses and worms were and anti-virus software was.

And personally I still liked it more when malware/supply chain attack actors assumed everyone was upgrading within a day or two while I was doing it after 7. You don't have to outrun the lion, just the guy slower than you and who's between you and the lion ;)