<![CDATA[I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously.]]>RE: https://infosec.exchange/@ifin/116605052950779161

I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. Initial access appears to be a compromised VS Code extension.

]]>https://board.circlewithadot.net/topic/b8855fef-cf6b-49e0-bdf3-f92c7dcf3067/i-m-really-hoping-this-and-the-last-few-weeks-are-a-tipping-point-toward-taking-supply-chain-security-seriously.RSS for NodeMon, 25 May 2026 07:56:26 GMTWed, 20 May 2026 04:40:17 GMT60<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 15:14:55 GMT]]>@mttaggart Not that we know which one and can check our own extensions to make sure we aren't compromised. That would be too much to ask!

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Epic_Null/statuses/116607555676238409https://board.circlewithadot.net/post/https://infosec.exchange/users/Epic_Null/statuses/116607555676238409Wed, 20 May 2026 15:14:55 GMT<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 12:56:44 GMT]]>@bovaz You know, I think the constant compromise of their repositories and credentials is something of a bother in and of itself

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/mttaggart/statuses/116607012354023295https://board.circlewithadot.net/post/https://infosec.exchange/users/mttaggart/statuses/116607012354023295Wed, 20 May 2026 12:56:44 GMT<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 09:49:03 GMT]]>@mttaggart@infosec.exchange my fear is it's going to lead to more expensive and annoying policies from companies, bothering developers, so that compromised stuff is immediately deployed at company-scale.]]>https://board.circlewithadot.net/post/https://misskey.social/notes/amhg1zkkf2https://board.circlewithadot.net/post/https://misskey.social/notes/amhg1zkkf2Wed, 20 May 2026 09:49:03 GMT<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 09:19:09 GMT]]>@mttaggart @peter that github news seems bad! 😳

]]>https://board.circlewithadot.net/post/https://tilde.zone/users/mk30/statuses/116606156759182704https://board.circlewithadot.net/post/https://tilde.zone/users/mk30/statuses/116606156759182704Wed, 20 May 2026 09:19:09 GMT<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 07:00:09 GMT]]>@mttaggart

“Taking supply chain security seriously” involves laying off the productivity obsession and allowing programmers to remain calm, focused, and vigilant.

I don't think we're anywhere near that tipping point, unfortunately. Companies and politicians still think we can solve this problem with audits, regulations, and hoop jumping.

I discussed this in another thread earlier today: https://mastodon.sdf.org/@argv_minus_one/116602229559669722

]]>https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/116605610175097926https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/116605610175097926Wed, 20 May 2026 07:00:09 GMT<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 05:22:45 GMT]]>@mttaggart I'm sure vibe coding will make securing the supply chain easier and not harder /s

]]>https://board.circlewithadot.net/post/https://critter.cafe/users/luxliquida/statuses/116605227226243359https://board.circlewithadot.net/post/https://critter.cafe/users/luxliquida/statuses/116605227226243359Wed, 20 May 2026 05:22:45 GMT<![CDATA[Reply to I'm really hoping this, and the last few weeks, are a tipping point toward taking supply chain security seriously. on Wed, 20 May 2026 04:45:53 GMT]]>@mttaggart Gives me the chills. As a solo dev, my entire livelihood is tied to the integrity of my toolchain, and there's only so much I can realistically audit myself.

]]>https://board.circlewithadot.net/post/https://mastodon.social/ap/users/116535831720048152/statuses/116605082261737233https://board.circlewithadot.net/post/https://mastodon.social/ap/users/116535831720048152/statuses/116605082261737233Wed, 20 May 2026 04:45:53 GMT