Thread
Stories related to "How Go Mitigates Supply Chain Attacks" across the full archive.
In the usual course of writing software, it's common to install huge dependency chains (npm, pypi), and any vulnerable package could spell doom. There's some nasty stuff out there, like https://pytorch.org/blog/compromised-nightly-dependency/ which uploaded people&...
How are companies protecting against the constant risk of supply chain attacks? Everything from a rogue package reading API keys on a dev machine to the XZ backdoor enabling remote execution on any server with exposed ssh.<p>It's not a new problem. There are many companies trying to solve it. A...
Welcome to "Scharf", a blazing-fast security scanner for hardening third-party GitHub actions with mutable references. Using mutable references (version tags, main/master/dev etc.) is a security vulnerability that can result in supply-chain attacks.<p>The recent `tj-actions/...