> The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with ha

> The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with hardware suppliers you are relying on the security of your vendor. Not necessarily — plenty software still ships with the third party supply chain bits incorporated as binaries, including commercial software. User is relying on security of one or more in a chain of upstream vendors. See Cyberpunk 2077 DLLs for instance. https://twitter.com/CDPRED_Support/status/1356604047671898112?s=20 https://twitter.com/CDPRED_Support/status/135660404767189811... Cyberpunk “builds” their game with a software build system, but not all of it is them building it.