7 ms·

I'm curious if this will start changing developers' attitudes regarding supply-chain vetting. My guess is that it won't for most, because convenience and exped

• wslh 3y ago
  I think is more about solving some supply-chain attacks. For example adding a hash in a central place to check if the CDN content is valid. Something around that.
• radicaldreamer 3y ago
  This is a well known and predictable attack vector. I’m surprised ledger didn’t already protect against it.
• jackb4040 3y ago
  It will not; this is an identical attack to the Copay wallet hack over 5 years ago. Solutions like lavamoat have been proposed and implemented in places, but they will not scale to the entire industry. There's a bigger problem in how innovation speed / developer convenience is inversely related to security. In many cases it's literally cheaper to just wait for an attack and make victims whole. And even if not, it's hard to explain to your investors why it takes you half a year to build a product that took your competitors a month, so you just pretend the threat doesn't exist.