11–20 of 187 posts
So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…
Earlier quoted context omitted.
> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.
I think this is just another opportunity to create new services. I've seriously considered moving all my stuff (except gaming) into something like apache guacamole. I'm already used to remote dev-ing over ssh and once you can easily get your desktop anywhere without even needing a client, there's no real reason to run everything on the one system you happen to be sitting at. And if internet connectivity is still an i…
theoretically.
in practice the added latency is a problem outside of casual use.
update: clarification seems to be neccessary as i was talking about audio/video/gaming type workload, NOT office stuff
So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…
So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…
There seems to be a fundamental trade-off at play. I often see security portrayed as a hindrance, requirements thereof as a drag on productivity. That is in line with a strong trend in developers with a very narrow skill set. The ability to throw framework at the wall and see what sticks pays very well. No one wants a stick in the mud asking why on Earth dependency management is at the state it is, or imposing reasonable security practices. I have been there, I have argued with developers from teams that had been breached before saying "no, this is safe because I can't see how this could be exploited". Security by obscurity so deeply ingrained one takes obscurity from oneself as evidence of safety.
I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and given we are still tiny dealing with a large amount of false positive (that was the case with snyk) is a pain. Just curious how others are dealing with this.
So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…
> how fragile software supply chain security is, despite the abundance of tools and available security mechanisms There seems to be a fundamental trade-off at play. I often see security portrayed as a hindrance, requirements thereof as a drag on productivity. That is in line with a strong trend in developers with a very narrow skill set. The ability to throw framework at the wall and see what sticks pays very well. N…
Earlier quoted context omitted.
> how fragile software supply chain security is, despite the abundance of tools and available security mechanisms There seems to be a fundamental trade-off at play. I often see security portrayed as a hindrance, requirements thereof as a drag on productivity. That is in line with a strong trend in developers with a very narrow skill set. The ability to throw framework at the wall and see what sticks pays very well. N…
It's worse, if you address these things seriously, like, as another post here addressed last week, about software quality, you get rapidly stopped in your tracks. Like you say and more; 'but everyone does it like this, why would we waste time?' and 'It is safe enough, maybe later we'll revisit'. It is kind of true clients don't pay for it directly, however, indirectly, it can tank a company.
Earlier quoted context omitted.
I think this is just another opportunity to create new services. I've seriously considered moving all my stuff (except gaming) into something like apache guacamole. I'm already used to remote dev-ing over ssh and once you can easily get your desktop anywhere without even needing a client, there's no real reason to run everything on the one system you happen to be sitting at. And if internet connectivity is still an i…
> there's no real reason to run everything on the one system you happen to be sitting at theoretically. in practice the added latency is a problem outside of casual use. update: clarification seems to be neccessary as i was talking about audio/video/gaming type workload, NOT office stuff