2 ms·

If you can't trust service providers, you probably also can't trust software suppliers.

• stego-tech 2y ago
  I mean, yes? It's why Zero Trust is growing as an operations model. Supply chain attacks, vendor hostility, zero days being hoarded by nations and bad actors for exploit, the list goes on. You emphatically cannot trust vendors, suppliers, users, software, systems, or governments. Ergo, your infrastructure should be built with an appropriate risk assessment in mind, and have proper safeguards in place where feasible. That's just good OpSec.
  • deleted 2y ago
    [deleted]
• kortilla 2y ago
  Not the same. In particular you don’t need to accept software updates from software suppliers and you can also require source code or use open source. This stuff was obvious and standard in the 80s-2000s. It’s only in the last 15-20 years that it became acceptable to get updates shoved down your throat. Service providers can cut off your access any day. Software providers cannot unless you’ve given them a live update channel direct to your env.
• drdaeman 2y ago
  Definitely not true. You can audit software (it could be not easy, but ultimately doable) and skip the updates until you have capacity to audit those. You can't audit a third-party service, no matter what you do.