This may be of interest: https://programming-journal.org/2023/7/1/ "Building a Secure Software Supply Chain with GNU Guix"
Ask HN: Pragmatic way to avoid supply chain attacks as a developer
21–23 of 23 posts
Re: Ask HN: Pragmatic way to avoid supply chain attacks as a developer
#22A large portion of my role at $DayJob is around improving supply chain security. Some examples of how we do it: - Devs can only use hardened (by us) Docker images hosted inside our infrastructure. Policies enforce this during CI and runtime on clusters. - All Maven/PIP/NodeJS/etc. dependencies are pulled through via proxy and scanned before first use. All future CI jobs pull from this internal cache. - Only a handful…
Sounds like you’re running a tight ship – congrats! Have you received feedback from your dev teams on the ergonomics of the setup?
Thanks! I was given a blank canvas and asked to build a platform which aligns with the company’s “cybersecurity” vision. They want more teams to align on how they build/deploy/manage products in a PCI regulated environment.
It’s quite challenging given I literally have 50 different “internal customers” (teams) who do things in their own silos - and have done for the last 20 years.
Definitely a marathon not a sprint and will take years to complete.
Re: Ask HN: Pragmatic way to avoid supply chain attacks as a developer
#23CycloneDX tools offer packages for each and every programming language. [1] The dependency track project accumulates all dependency vulnerabilities in a dashboard. [2] Container SBOMs can be generated with syft and grype [3] [4] [1] https://github.com/CycloneDX [2] https://github.com/DependencyTrack [3] https://github.com/anchore/syft [4] https://github.com/anchore/grype
SBOMs can't flag vulnerable dependencies until after those are publicly known. Traceability is useful when mitigating a crisis, but it won't prevent one.
> Traceability is useful when mitigating a crisis, but it won't prevent one.
So how do you prevent a crisis then without knowing what your software stack has as dependencies?