In my raw, sore and offending, dry opinion: for dependencies, if a student write a small chat client he/she is excused for not knowing, studied and checked all

In my raw, sore and offending, dry opinion: for dependencies, if a student write a small chat client he/she is excused for not knowing, studied and checked all the deps he/she use. If a big enterprise with significant development teams pull code from git head of some project directly to production it's about time to look for a big mast, glue and sand. They deserve the outcome. For CI/CD and some other cited attacks: again a student can be excused, a bit company MUST have it's own infra with it's internal operation, security etc. If that's not the case just because it's easy and cheap pay less internal technicians and talk more with colleagues commercials from some other companies whose jobs is just selling someone else technicians services with an automated UI they deserve the outcome. Distracted devs who publish credentials, distracted admin who left default pig&dogs open instance of some services etc can always happen but if it's more than once in a while for a quickly fired employee than that means a complete IT department re-build is needed. Please do not tell me the joke about the need of being quick and agile etc. Modern crapstructure are quick only in making disasters. To be really quick we need to came back in the history, restart completely erasing modern IT from IBM and onward and learn how to work properly, this, yes, is far from being quick, but that's the sole reasonable option I see. Keeping layering crap to offload crappy unsolvable problems to third parties like "cure the symptom > cure the the problem" is only a recipe for a worse disaster, like re-paint a wall with a broken corroded pipe behind: initially you quickly solve for few days, than for one day, than you haven't even the time to finish painting. More real supply chain attacks, like some SoC who do not work as they say they do... There is only one mitigation: open hardware and internal production, the latter can't be done essentially by anyone, the former must be mandatory by law IMO.