Technological Exhibitionism: Fewer Supply Chain Attacks
summary
The talk examines software supply-chain risk in production systems, noting that under 1% of deployed code is authored directly while ~99% are transitive dependencies from third-party and open-source packages. It analyzes questions about the quality, maintenance, and contributor base of those dependencies, highlights that simple attacks against widely shared critical packages create major vulnerabilities, and explores how making dependency ecosystems more transparent (“technological exhibitionism”) offers promising mitigations.
AI-written summary · about
chapters (9)
- 0:00Tech exhibitionism intro
- 3:10Supply chain failures
- 7:30Library risks
- 10:45Critical package problems
- 12:29Nudity and transparency
- 16:01Publish incidents
- 18:56Cyber labeling standards
- 21:06Dogfooding
- 22:32Legal consequences
related talks
37mSupply Chain Attacks and the Future of Software Delivery
25mYour Software Supply Chain is Only as Secure as its Weakest Link
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy- 25mYour Software Supply Chain is Only as Secure as its Weakest Link
25mSupply Chain Attacks
41mManaging the Risk of Software Supply Chain Attacks
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
35mSupply Chain Attacks: The New Reality