Post

so much money pouring into supply chain security scanning and the actual attack surface is just... a maintainer trusting someone who seemed helpful. no lockfile prevents that

Actually, it was extactly the same Joan Alaverda dude from OpenFort. socket.dev/blog/attacke...

I may be old, but in a previous company, we had a policy to only use Debian Stable unless inhouse devs were intimately familiar (e.g. being devs) with upstream code. Slow, but I tend to think we had the right idea. 🤔

I don't really keep any keys accessible on my machine so I'm happy to trust registries that haven't been compromised in decades. It's a risk but if you can't trust registries we wouldn't use package managers and they haven't fucked up yet.

This is an argument against automated dependency management not one against lockfiles. If someone isn't looking at the diffs of the dependency code you're running you're vulnerable regardless of how you import the code.

?!?

I think a lot of cyber insurance reinsurers and retrocessionaires will be in trouble. Thinking about the NotPetya fallout (Merck settling a $1.4 billion lawsuit against their insurers), state-backed adversaries like North Korea and Iran, and how updated war exclusions can't be proven to apply.

“the meeting said something on my system was out of date.” The meeting said… I don’t get this bit tbh. If anything else other than teams or slack tells you to upgrade then any technologist worth their salt should be raising not one but all eyebrows at the same time.

Crypto founders and VCs have been seeing this for years. It’s time to move the conversation about video-call scams to everyone. We still don’t have a good defense protocol for this; social engineering is way too effective