←back to thread

Fifty Years of Open Source Software Supply Chain Security

(queue.acm.org)
182 points yarapavan | 1 comments | 07 Apr 25 18:04 UTC | HN request time: 0.001s | source
Show context
mlinksva ◴[07 Apr 25 18:31 UTC] No.43614464[source]▶
Good article for what it covers, but sadly does not cover isolation/sandboxing/least privilege.
replies(2): >>43614987 #>>43615031 #
bitwize ◴[07 Apr 25 19:34 UTC] No.43615031[source]▶
Indeed. In 2020s, if you're not sandboxing each thing, and then sandboxing each library the thing depends on, you're running with way too many opportunities for vulnerability.
replies(1): >>43615529 #
LtWorf ◴[07 Apr 25 20:19 UTC] No.43615529[source]▶
Well said! How?
replies(3): >>43615593 #>>43617134 #>>43617404 #
bitwize ◴[07 Apr 25 20:26 UTC] No.43615593[source]▶
I have no freaking idea. Needless to say I don't think our current operating systems are up to the task of actually being secure. You have to be able to somehow dynamic-link in a library whilst only giving calls into that library certain permissions/capabilities... which I don't think even Windows can do.
replies(4): >>43615767 #>>43615910 #>>43616588 #>>43617962 #
1. gizmo686 ◴[07 Apr 25 22:22 UTC] No.43616588[source]▶
Forget OS support, is that something that modern CPUs can support efficiently? As far as I can tell, enforcing a security boundary across libraries would require changing the page table twice for every library call, which seems like a big performance hit.