What's interesting about the main SolarWinds subversion was a build environment subversion. It didn't matter how much source code review was done. To detect/cou

What's interesting about the main SolarWinds subversion was a build environment subversion. It didn't matter how much source code review was done. To detect/counter this kind of attack you need different measures. Start by hardening the build environment, but if you want real strength you need reproducible builds. For more info see: https://www.linuxfoundation.org/en/blog/preventing-supply-chain-attacks-like-solarwinds/ https://www.linuxfoundation.org/en/blog/preventing-supply-ch...