To secure the supply chain, you must properly fund it
1–10 of 59 posts
Re: To secure the supply chain, you must properly fund it
#2Facebook Hacked? 7 Things You Need To Do Right Now!: https://www.hackerslist.co/facebook-hacked-7-things-you-need...
Re: To secure the supply chain, you must properly fund it
#3Is this "supply chain" or "infrastructure?"
Re: To secure the supply chain, you must properly fund it
#4Is this "supply chain" or "infrastructure?"
2020/21 buzzword relating to anything that is an external dependency...
Annoying.
Re: To secure the supply chain, you must properly fund it
#5Is this "supply chain" or "infrastructure?"
FOSS supply chain... so many people using that project, not contributing squat, not security reviews, not anything... just bring it in as a magic dependency for $0.
Re: To secure the supply chain, you must properly fund it
#6[deleted]
Re: To secure the supply chain, you must properly fund it
#7> When corporations sponsor the maintenance of the FOSS projects they use, they are effectively buying an insurance policy that guarantees a prompt, well-coordinated response to security problems.
Unless there's a contract explicitly stating so, this is not true whatsoever. If you want an "insurance policy" of this kind, hire the maintainer or pay for an actual support contract from them.
Donations are exactly that, donations. Maintainers are under no obligation to do anything for you just because you donated money to them.
There is a reason most FOSS licenses include a NO WARRANTY, PROVIDED AS-IS clause.
Re: To secure the supply chain, you must properly fund it
#8It should be noted up front that paying money for this stuff doesn't secure it either. There are frequent security bugs from well maintained projects too. It does help though.
The best defence against this sort of catastrophic bug creeping up into a project is an aggressively simplified dependency tree. It isn't easy, and in some (most?) cases it might be most sensible to take on the risk and wait to fix bugs found in the wild. But if a project has 100 external dependencies - which is easy to do when a dependency tree gets deep - then maybe one of those maintainers will have reached a 1-in-100 level of corruption and evil. At that point, they might be slipping this sort of thing in on purpose. Securing a dependency chain is without doubt expensive.
Re: To secure the supply chain, you must properly fund it
#9> When corporations sponsor the maintenance of the FOSS projects they use, they are effectively buying an insurance policy that guarantees a prompt, well-coordinated response to security problems. Unless there's a contract explicitly stating so, this is not true whatsoever. If you want an "insurance policy" of this kind, hire the maintainer or pay for an actual support contract from them. Donations are exactly that,…
While contracts matter,relationships are also a thing - if you are donating and they are developing, you are funding development.
Re: To secure the supply chain, you must properly fund it
#10It's kind of crazy that Apple has had the greatest visionary CEO of all time (Steve Jobs) while also having the greatest supply chain manager of all time (Tim Cook).
It's no surprise that Apple is the most valuable company in the world and also the most beloved brand.