Are We Forever Doomed to Software Supply Chain Security?
summary
Shows concrete failures: the event-stream backdoor compromises a Bitcoin wallet via a dependency chain, 14 npm modules were writable because of weak passwords, and a researcher in Jan 2021 exploits VS Code CI via command injection to run shells. Measurements include 61% abandoned npm packages and 100 days average fix time for JS/Python vulnerabilities; 2FA adoption sits at ~7–9%. A sudo flaw hides for ten years and package-manager design flaws let researchers impersonate vendors at Apple and Microsoft.
AI-written summary · about
chapters (11)
- 0:00Intro
- 4:17The event-stream incident
- 6:27electron-native-notify The event stream incident
- 7:11Attacking the heart of developer tooling
- 8:38How do maintainers mitigate security vulnerabilities?
- 9:30The case of marked's Cross-site Scripting vulnerability
- 10:36Compromising Maintainer Accounts
- 11:36Can we do better for account security hygiene?
- 12:31given enough eyeballs, all bugs are shallow
- 14:06What happens when maintainer: remove their libraries?
- 14:40What's inside these registries?
related talks
16mAre we Forever Doomed to Software Supply Chain Security?
42mSecuring Your Software Supply Chain
23mProtecting Your npm Dependencies
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...