4 ms·

Some random thoughts: - every Fortune 500 company tracks exactly which FOSS code it includes in its ecosystem (usually code scanning and fingerprinting - can’t

Some random thoughts: - every Fortune 500 company tracks exactly which FOSS code it includes in its ecosystem (usually code scanning and fingerprinting - can’t remember the usual Provider of such) - this is essentially the software BOM that Biden signed a while back. - this (made public) would give a real time map of the dependancies of all organisations - and linking that to things like the above thread (“cry for help”) would be an interesting place for “intervention” - anything from plain old cash to “here are three interns doing two years in gov.uk. They will help for the next 2 years (It’s not a great idea that last one but we need to start somewhere- no way can government “pick winners” but also no way can society just sit back and hope. And commercial incentives break this horribly. Essentially we are going to find at some point we treat some developers like lawyers - this stuff is our societies laws, rules, processes

kzrdude 3y ago
> “here are three interns doing two years in gov.uk. They will help for the next 2 years Having temp workers come and go into all kinds of various open source projects.. does that help? :)
- lifeisstillgood 3y ago
  Does two years count as temp? What if one in five stays on for “life” I am not claiming I have perfect solutions, just that we need to be more mindful of our supply chains. And when we are we start demanding things of those supply chains - and if we are sensible we support those suppliers
klabb3 3y ago
Agreed it’s a decent way to create a “map” of vulnerable projects. But it’s over-fitting the MO of adversaries - plugging an arbitrary hole. Why not play into the strengths of OSS instead of trying to replicate frictionous trust models from elsewhere? Like, listen to ourselves. We are admitting here that open source software is not feasible to audit? Like did we just accept that an adversary can basically smuggle exploit payloads in plain sight? Can we at least try to simplify and reduce the messiness of checked in generated code, irreproducible builds, and magical binary blobs, conditional compilation, “ifuncs”? Wtf? Granted I’m not a domain expert in this area, but I’m horrified by all the complexity for what I understand to be a compression library. I would much rather play whack-a-mole with obscurity, which as a side effect is great for software quality overall.
- lifeisstillgood 3y ago
  I have to admit that is a good point - myself I think there is some other goal here - I am trying to build reproducible workstations and servers (nix os). And until right now I have not even considered can I put all the source code I am sitting on in one place. God knows if I could. It that has to be the first place to start

kzrdude 3y ago

> “here are three interns doing two years in gov.uk. They will help for the next 2 years Having temp workers come and go into all kinds of various open source projects.. does that help? :)

lifeisstillgood 3y ago
Does two years count as temp? What if one in five stays on for “life” I am not claiming I have perfect solutions, just that we need to be more mindful of our supply chains. And when we are we start demanding things of those supply chains - and if we are sensible we support those suppliers

klabb3 3y ago

Agreed it’s a decent way to create a “map” of vulnerable projects. But it’s over-fitting the MO of adversaries - plugging an arbitrary hole. Why not play into the strengths of OSS instead of trying to replicate frictionous trust models from elsewhere? Like, listen to ourselves. We are admitting here that open source software is not feasible to audit? Like did we just accept that an adversary can basically smuggle exploit payloads in plain sight? Can we at least try to simplify and reduce the messiness of checked in generated code, irreproducible builds, and magical binary blobs, conditional compilation, “ifuncs”? Wtf? Granted I’m not a domain expert in this area, but I’m horrified by all the complexity for what I understand to be a compression library. I would much rather play whack-a-mole with obscurity, which as a side effect is great for software quality overall.

lifeisstillgood 3y ago
I have to admit that is a good point - myself I think there is some other goal here - I am trying to build reproducible workstations and servers (nix os). And until right now I have not even considered can I put all the source code I am sitting on in one place. God knows if I could. It that has to be the first place to start