3 ms·
I can't emphasize enough how much of a genuine issue this is, especially where package managers are being used on production environments or within CI/CD pipeli
by dotBen 2y ago
I can't emphasize enough how much of a genuine issue this is, especially where package managers are being used on production environments or within CI/CD pipelines. There's enough publicized cases of Chinese CCP operatives gaining pull request access to key packages, and I'm sure many more get discovered that are covered up/not made public. Even just turn over of package ownership from reputable entities to lesser known individuals is of course worrying.
As a SWE/EngMgr turned VC, I'm curious if there's startups or commercial companies providing some kind of assurance here (but also worried the $ TAM for solving this problem probably isn't enough to make it a standalone business).
- brimwats 2y ago> enough publicized cases of Chinese CCP operatives gaining Like? not doubting you, just not aware of multiple cases beyond the big near-miss earlier this year
- lionkor 2y agoAh yes, the "bad guys".
- 0xedd 2y agoYeah, well, harvesting human organs (selling them to US customers) and maintaining death camps in 2024 is kind of "bad guys" for me. But, to each his own, I suppose. https://www.ohchr.org/en/press-releases/2021/06/china-un-human-rights-experts-alarmed-organ-harvesting-allegations https://www.ohchr.org/en/press-releases/2021/06/china-un-hum... https://theconversation.com/killing-prisoners-for-transplants-forced-organ-harvesting-in-china-161999 https://theconversation.com/killing-prisoners-for-transplant... https://www.bbc.com/news/world-asia-china-54277430 https://www.bbc.com/news/world-asia-china-54277430 Other than these small misdemeanours, they're saints! Doubly so on the internet. /s
- lenkite 2y agoThe U.S. also harvests the organs of dead prisoners without consent. This is well-documented. 2 Democratic senators even proposed a bill to "reduce sentences" by "donating" your organs. The U.S. runs the world's most extensive biological weapons research program and firmly opposes any verification for the BWC to which the U.S. is a signatory. The Pentagon operates a ridiculous number of bio labs in other nations. The U.S. NIH was indirectly responsible for Covid - thanks to sponsorship of gain-of-function research into bat coronaviruses via the Ecohealth alliance, sponsorship of which was approved by good old "I represent Science" Dr Fauci. A massive and desperate cover up operation was performed by the NIH here. Hell, there were e-mails sent to delete everything and deflect all inquiries. The U.S. deliberately sponsors coups in nations across the world for leaders they don't like - as evidenced by de-classified documents. The U.S. military budget is 7 times higher than that of China. Nearly a million people were killed directly and in-directly in Yemen thanks to good old American bombs. Let's not even get into earlier acts - like Obama's "moderate rebels" in Syria who were busy chaining women in Aleppo and who devolved into ISIS after the Syrian army kicked them out and decided to conquer Iraq instead - all with the latest American weaponry in hand! (I strongly suggest speaking to a native Syrian who lived in Aleppo during that time to know about the horror) Other than these very small misdemeanours, the U.S. is a saint! Doubly so on the internet. /s
- aibrahem 2y agoSo is aiding and actively supporting a genocide and celebrating a war criminal, so what is your point?