Supply chain incidents suck and we need to do better. Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.

This is the most SCP thing I've read in a while that's not actually an SCP.

Customers give us heat for not shipping the latest vulpine-lz4. Their AI-based heuristic antivirus total defence solution automatically flags all software not running latest versions of everything

Kindly advice

For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)

absolutely hilarious, made me laugh a lot. thank you for writing this, whether human or AI.

It's easy to be cynical because, yes, both the problems and solutions seem dead obvious in hindsight. But for a long time (and maybe even still), a hacker creed was "move fast and break things."

It's great that there's so much momentum in fixing the glaring problems with supply chain systems like npm, but I'm concerned that we're entering a new era of security-related problems caused in large part by agentic development.

I'm not just talking about Mythos/Glasswing surfacing vulnerabilities in pretty much everything it touches; I think the way we're developing software, pulling in dependencies, and potentially losing human thought modeling of complex systems is going to lead to a lot of hacked together software and infrastructure that humans won't fully understand.

I hope in a few years we don't look back at today and wonder how we could have been so naive -- how we failed to actually plan for the long-tail of AI development in a way that doesn't solve problems by attempting to just use AI to rebuild complex systems.

But the article was funny.

This week has been tough. Is it the begging of CVEgeddon?

Recently I've been wondering why I really need MFA tokens for everything.

The initial thought was this is security culture but a few cocktails later and a discussion with a friend rather high up in the intelligence services in my country lead to a different conclusion, which aws indirectly:

I rely on too-much-shit from god-knows-where written by fuck-knows and a lot of what-the-hell running in some awful-cloud-shit.

Our supply chain problems are because the whole idea above. As is the fact I need to auth to a million things which I shouldn't have to.

Give me a boxed copy of Visual Basic with manuals and lock me in a fucking basement with an airgapped NT4 box until this all over please.

Very enjoyable read, entirely too close to the mark