Fifty Years of Open Source Software Supply-Chain Security (cacm.acm.org)
from who@feddit.org to programming@programming.dev on 21 Sep 17:39
https://feddit.org/post/19162657

#programming

threaded - newest

who@feddit.org on 21 Sep 17:49 next collapse

The essay includes several bits of advice for improving security in our field. IMHO, we overlook this one far too often:

Gordon Bell once observed that “[t]he cheapest, fastest and most reliable components of a computer system are those that aren’t there.” The most secure software dependencies are the ones not used in the first place: Every dependency adds risk.

bacon_pdp@lemmy.world on 21 Sep 18:17 next collapse

Entirely missed bootstrappable build; they solved the entire Trusting Trust Attack

Static_Rocket@lemmy.world on 21 Sep 18:49 collapse

I’m a little disappointed in the amount of time spent on the XZ attack. The title and it starting off with some good history made me think this was going to be more of a retrospective, looking into the issues that created the solutions used today.

It seems to be just calling out the solutions and how they would interfere or did interfere with a given attack, where XZ is most commonly used as an example.