3 ms·
I personally think this kind of thing is just a symptom of a larger problem; the modern open source software ecosystem is highly vulnerable to supply chain atta
by Ajedi32 5y ago
I personally think this kind of thing is just a symptom of a larger problem; the modern open source software ecosystem is highly vulnerable to supply chain attacks.
Frankly, given how normal it is to just blindly download unverified, unsandboxed code from random developers and execute it on our machines it's surprising this sort of incident isn't more common.
What we need are better tools and processes to detect and block malicious code in dependencies before it has a chance to execute. I wrote up a few suggestions for that several months ago and I think they're still applicable: https://news.ycombinator.com/item?id=29266992 https://news.ycombinator.com/item?id=29266992
- rectang 5y agoQuorum publishing would help a lot, and is doable. It would guard against supply chain attacks where the identity of a publisher is taken over by an attacker, by multiplying the difficulty and requiring multiple takeovers. However, it would not fully guard against a conspiracy by people willing to burn their reputations, as in the "peacenotwar" attack. Per-dependency sandboxing and permissions might mitigate things to a degree, just as it has on iOS etc with apps. But it would require a different software module architecture than we have today for common languages.