There was a fun one a few years ago when someone realized that Maven Central didn't require https so anyone could MITM arbitrary amounts of open source Java cod

There was a fun one a few years ago when someone realized that Maven Central didn't require https so anyone could MITM arbitrary amounts of open source Java code. But I think this problem could be even more pervasive. Think about that giant green lock icon you see on secured sites. And then think about all the apps and devices making requests with no UI and we have no idea what they're all talking to until you have the patience and knowhow to operate wireshark. Off the top of my head, the only real solution is to feed a lot of this arbitrary traffic through trusted brokers which is going to make us even more dependent on Google, Microsoft or whoever else takes up that mantle.