4 ms·

Detecting supply chain attacks at the end-developer level using such tooling is rarely going to pan out. Developers just don't care enough. There is a considera

by r9295 3y ago

Detecting supply chain attacks at the end-developer level using such tooling is rarely going to pan out. Developers just don't care enough. There is a considerable increase in effort required when such defences are introduced. Also, there are too many things to keep track of for the authors of such approaches. Eg: How would this tool handle changes in the standard library API? Languages and repositories need to be funded appropriately to solve a problem that is systemic. I've played with several methods, built tooling around this problem (github.com/R9295). Hell, my thesis is going to be about supply chain security. Solutions that inform the developer and allow them to make decisions don't work. I get that there is no absolute defence and security is layered etc. But these approaches feel hacky

bornfreddy 3y ago
I respectfully disagree. I care about supply chain attacks to the level that I only use reputable, preferably small dependencies. I check their dependencies too. However if I could limit their interface to a limited set of operations and be warned if a new version changed the APIs it uses, I would be exstatic. This goes into CI so I don't need to remember to run it, so it is fire-and-forget. Kind of CSP for JS (in browser). Not using Rust though (yet?), so can't vouch for Cackle. Great idea though.
xoac 3y ago
They would care if it was part of their job
pjmlp 3y ago
They are forced to care when their employer does. Hence why many companies force internal repos on CI/CD, and dependencies only uploaded after legal clearance.
xpe 3y ago
> Detecting supply chain attacks at the end-developer level using such tooling is rarely going to pan out. Even if true, the uptake fraction (e.g. usage %) isn’t the key point: to provide an additional (rather novel to boot) layer of analysis and therefore security. Remember: security is layered. > Developers just don't care enough. Even if narrowly true, this neglects to recognize that developers exist in varied situational contexts. When properly motivated, some can use these kinds of tools.

by r9295 3y ago

bornfreddy 3y ago

I respectfully disagree. I care about supply chain attacks to the level that I only use reputable, preferably small dependencies. I check their dependencies too. However if I could limit their interface to a limited set of operations and be warned if a new version changed the APIs it uses, I would be exstatic. This goes into CI so I don't need to remember to run it, so it is fire-and-forget. Kind of CSP for JS (in browser). Not using Rust though (yet?), so can't vouch for Cackle. Great idea though.

xoac 3y ago

They would care if it was part of their job

pjmlp 3y ago

They are forced to care when their employer does. Hence why many companies force internal repos on CI/CD, and dependencies only uploaded after legal clearance.

xpe 3y ago

> Detecting supply chain attacks at the end-developer level using such tooling is rarely going to pan out. Even if true, the uptake fraction (e.g. usage %) isn’t the key point: to provide an additional (rather novel to boot) layer of analysis and therefore security. Remember: security is layered. > Developers just don't care enough. Even if narrowly true, this neglects to recognize that developers exist in varied situational contexts. When properly motivated, some can use these kinds of tools.