The essay includes several bits of advice for improving security in our field. IMHO, we overlook this one far too often:
Gordon Bell once observed that “[t]he cheapest, fastest and most reliable components of a computer system are those that aren’t there.” The most secure software dependencies are the ones not used in the first place: Every dependency adds risk.
bacon_pdp@lemmy.world
on 21 Sep 18:17
nextcollapse
Entirely missed bootstrappable build; they solved the entire Trusting Trust Attack
Static_Rocket@lemmy.world
on 21 Sep 18:49
collapse
I’m a little disappointed in the amount of time spent on the XZ attack. The title and it starting off with some good history made me think this was going to be more of a retrospective, looking into the issues that created the solutions used today.
It seems to be just calling out the solutions and how they would interfere or did interfere with a given attack, where XZ is most commonly used as an example.
threaded - newest
The essay includes several bits of advice for improving security in our field. IMHO, we overlook this one far too often:
Entirely missed bootstrappable build; they solved the entire Trusting Trust Attack
I’m a little disappointed in the amount of time spent on the XZ attack. The title and it starting off with some good history made me think this was going to be more of a retrospective, looking into the issues that created the solutions used today.
It seems to be just calling out the solutions and how they would interfere or did interfere with a given attack, where XZ is most commonly used as an example.