3 ms·
I wish that community effort actually worked, but the truth is almost no one reviews 99% of the open source libraries linked into every app, let alone the binar
by lrvick 3y ago
I wish that community effort actually worked, but the truth is almost no one reviews 99% of the open source libraries linked into every app, let alone the binary blob drivers and OMA-DM toolkits with root access to your phone controlled by Apple/Google and Qualcomm.
Truly no e2ee chat is safe if even one person accesses it from a smartphone with code the community cannot review, or is not actively reviewing.
Until we have 100% open code on endpoints with auditable hardware (like the Precursor) and have crowd sourced signed code reviews... we are vulnerable to any company, state actor, or teen that phishes the credentials to an NPM repo.
The state of software supply chain integrity today is about as good as hospital sanitation practices in the 1800s.
- __MatrixMan__ 3y agoCommunities coming together to protect themselves against a common enemy is something that we've been doing for perhaps a million years. We're actually quite good at it. But there hasn't yet been a market for tooling that brings those instincts into the realm of software. So far it has been "trust us, we're the vendor," and not "let's use this to trust each other but not our enemy". I agree that our software supply chains are in their infancy. Regrettably, so is our ability to use software to inflict harm (if you haven't played Cyberpunk 2077, it has a pretty good take on this--you spend a lot of time killing people by hacking into their implants). I hate to be gloomy, but I think that as the threats become more real, more deadly, the supply chain integrity piece will have to level up as well.