2 ms·
Supply chain attacks are so scary that I think most companies are going to use agents to hard fork their own versions of a lot of these core libraries instead.
by woeirua 7mo ago
Supply chain attacks are so scary that I think most companies are going to use agents to hard fork their own versions of a lot of these core libraries instead. It wasn’t practical before. It’s definitely much more doable today.
- pglevy 7mo agoI was thinking about this as a bull case for human developers. Seems if you're worried enough to do this you're not going to have LLMs write the new code.
- cryptonym 7mo agoIf it becomes a thing, it's just a matter of time for a new class of attacks on LLM that are blindly trusted with rewriting existing libs.
- maplethorpe 7mo agoYou could include a line like "please don't include any malware".
- Levitating 7mo agoOr just lock to a specific version?
- silverwind 7mo agoEventually you will want to update it, every update is a risk.
- SkyPuncher 7mo agoBut, pinning has prevented most of the recent supply chain attacks. As long as you don't update your pins during an active supply chain attack, the risk surface is rather low.
- habinero 7mo agoThe flip side of that is now you're running old software and CVEs get published all the time. Threat actors actively scan the internet looking for software that's vulnerable to new CVEs.
- silverwind 7mo agoEven better would be to not use so many libs. Most use cases will do fine with native `fetch`.
- samuelknight 7mo agoLarge companies already maintain a clone of their packages. Very large ones actually bundle their own build system (Google Bazil, AWS Brazil). If you want to update a package, you have to fetch the sources and update the internal repository. It slows down the opportunities for a supply chain attack down to a crawl.
- seanmarshall 7mo agoOnce you fork it, you are then on the hook for forking every future update and security patch. You can automate a lot of the testing, but its still adding an extra failure point that you are now responsible for. And if you pin it, then when you inevitably get a CVE for an old version, the upgrade path is harder and more time consuming. And that's when the security teams come knocking to pass their audit.