7 ms·

So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet

by lpapez 3y ago

So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet it takes a developer debugging performance issues to find an actual compromise. I worked in the software supply chain field and cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong.

r0ckarong 3y ago
> cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong. That's the entire point. You did everything you could by getting someone else look at it and saying it's fine.
- numpad0 3y ago
  This needs a Rust joke. You know, the problem with the whole certification charade is it slows down jobs and prevents __actual_problems getting evaluated. But is it safe?
bawolff 3y ago
> the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong. That is actually a major point of a lot of corporate security measures (shifting risk)
- landownersubgrp 3y ago
  And that's a good thing.
keepamovin 3y ago
If you installed xz on macOS using brew, then you have xz (XZ Utils) 5.6.1 liblzma 5.6.1 which are within the release target for the vuln. As elsewhere in these comments, people say macOS effect is uncertain. If concerned you can revert to 5.4.6 with brew upgrade xz
- neodypsis 3y ago
  It's been reverted now: https://github.com/Homebrew/homebrew-core/blob/9a0603b474804ef76cef17cf1bc90397996088bb/Formula/x/xz.rb https://github.com/Homebrew/homebrew-core/blob/9a0603b474804...
  - keepamovin 3y ago
    Yeah it was when I posted the comment too. That's why you could type brew upgrade xz and it went back to 5.4.6 I guess? But it might have been around that time, cutting it fine, not out for everybody. I don't know. Comment race condition haha! :)
- pjl 3y ago
  Similarly if you're using MacPorts, make sure to sync and upgrade xz if you have it installed. 5.6.1 was available for a few days and just rolled back ~20 minutes ago: https://github.com/macports/macports-ports/commit/a1388aee09c9e921e3a9d47cf9d37e5d3f3c10ad https://github.com/macports/macports-ports/commit/a1388aee09...
- quinncom 3y ago
  Thank you for this tip. `brew upgrade xz` worked. I was going to uninstall but it's used by so many things… brew uninstall xz Error: Refusing to uninstall /opt/homebrew/Cellar/xz/5.6.1 because it is required by aom, composer, curl, ffmpeg, gcc, gd, ghostscript, glib, google-cloud-sdk, grc, harfbuzz, httpie, img2pdf, jbig2enc, jpeg-xl, leptonica, libarchive, libavif, libheif, libraw, libtiff, libzip, little-cms2, numpy, ocrmypdf, openblas, openjpeg, openvino, php, pillow, pipx, pngquant, poppler, python@3.11, python@3.12, rsync, tesseract, tesseract-lang, unpaper, webp, wp-cli, yt-dlp and zstd, which are currently installed.
  - keepamovin 3y ago
    You're welcome!
CableNinja 3y ago
Thats basically the whole point actually... A company pays for insurance for the business. The insurance company says sure we will insure you, but you need to go through audits A B and C, and you need certifications X and Y to be insured by us. Those audits are often industry dependent, mostly for topics like HIPAA, PCI, SOC, etc. Insurance company hears about supply chain attacks. Declares that insured must have supply chain validation. Company goes and gets a shiny cert. Now when things go wrong, the company can point to the cert and go "it wasnt us, see we have the cert you told us to get and its up to date". And the company gets to wash their hands of liability (most of the time).
- 77pt77 3y ago
  > And the company gets to wash their hands of liability (most of the time). Certification theater. It's completely performative.
- landownersubgrp 3y ago
  What you describe is a normal process in order to minimise damage from attacks. The damage of hacking is ultimately property damage. The procedures you've described allow you to minimise it. And that's a good thing.
deleted 3y ago
[deleted]
markus_zhang 3y ago
That's the entire point of certification, and any certification at all. Certification does not guarantee performance. Actually, I would always cast a suspect glance to anyone who is FOCUSED on getting certification after certification without any side project.

by lpapez 3y ago

r0ckarong 3y ago

> cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong. That's the entire point. You did everything you could by getting someone else look at it and saying it's fine.

numpad0 3y ago
This needs a Rust joke. You know, the problem with the whole certification charade is it slows down jobs and prevents __actual_problems getting evaluated. But is it safe?

bawolff 3y ago

> the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong. That is actually a major point of a lot of corporate security measures (shifting risk)

landownersubgrp 3y ago
And that's a good thing.

keepamovin 3y ago

If you installed xz on macOS using brew, then you have xz (XZ Utils) 5.6.1 liblzma 5.6.1 which are within the release target for the vuln. As elsewhere in these comments, people say macOS effect is uncertain. If concerned you can revert to 5.4.6 with brew upgrade xz

neodypsis 3y ago
It's been reverted now: https://github.com/Homebrew/homebrew-core/blob/9a0603b474804ef76cef17cf1bc90397996088bb/Formula/x/xz.rb https://github.com/Homebrew/homebrew-core/blob/9a0603b474804...
- keepamovin 3y ago
  Yeah it was when I posted the comment too. That's why you could type brew upgrade xz and it went back to 5.4.6 I guess? But it might have been around that time, cutting it fine, not out for everybody. I don't know. Comment race condition haha! :)
pjl 3y ago
Similarly if you're using MacPorts, make sure to sync and upgrade xz if you have it installed. 5.6.1 was available for a few days and just rolled back ~20 minutes ago: https://github.com/macports/macports-ports/commit/a1388aee09c9e921e3a9d47cf9d37e5d3f3c10ad https://github.com/macports/macports-ports/commit/a1388aee09...
quinncom 3y ago
Thank you for this tip. `brew upgrade xz` worked. I was going to uninstall but it's used by so many things… brew uninstall xz Error: Refusing to uninstall /opt/homebrew/Cellar/xz/5.6.1 because it is required by aom, composer, curl, ffmpeg, gcc, gd, ghostscript, glib, google-cloud-sdk, grc, harfbuzz, httpie, img2pdf, jbig2enc, jpeg-xl, leptonica, libarchive, libavif, libheif, libraw, libtiff, libzip, little-cms2, numpy, ocrmypdf, openblas, openjpeg, openvino, php, pillow, pipx, pngquant, poppler, python@3.11, python@3.12, rsync, tesseract, tesseract-lang, unpaper, webp, wp-cli, yt-dlp and zstd, which are currently installed.
- keepamovin 3y ago
  You're welcome!

CableNinja 3y ago

Thats basically the whole point actually... A company pays for insurance for the business. The insurance company says sure we will insure you, but you need to go through audits A B and C, and you need certifications X and Y to be insured by us. Those audits are often industry dependent, mostly for topics like HIPAA, PCI, SOC, etc. Insurance company hears about supply chain attacks. Declares that insured must have supply chain validation. Company goes and gets a shiny cert. Now when things go wrong, the company can point to the cert and go "it wasnt us, see we have the cert you told us to get and its up to date". And the company gets to wash their hands of liability (most of the time).

77pt77 3y ago
> And the company gets to wash their hands of liability (most of the time). Certification theater. It's completely performative.
landownersubgrp 3y ago
What you describe is a normal process in order to minimise damage from attacks. The damage of hacking is ultimately property damage. The procedures you've described allow you to minimise it. And that's a good thing.

deleted 3y ago

[deleted]

markus_zhang 3y ago

That's the entire point of certification, and any certification at all. Certification does not guarantee performance. Actually, I would always cast a suspect glance to anyone who is FOCUSED on getting certification after certification without any side project.