←back to thread

Fifty Years of Open Source Software Supply Chain Security

(queue.acm.org)
182 points yarapavan | 1 comments | 07 Apr 25 18:04 UTC | HN request time: 0.236s | source
Show context
mlinksva ◴[07 Apr 25 18:31 UTC] No.43614464[source]▶
Good article for what it covers, but sadly does not cover isolation/sandboxing/least privilege.
replies(2): >>43614987 #>>43615031 #
bitwize ◴[07 Apr 25 19:34 UTC] No.43615031[source]▶
Indeed. In 2020s, if you're not sandboxing each thing, and then sandboxing each library the thing depends on, you're running with way too many opportunities for vulnerability.
replies(1): >>43615529 #
LtWorf ◴[07 Apr 25 20:19 UTC] No.43615529[source]▶
Well said! How?
replies(3): >>43615593 #>>43617134 #>>43617404 #
bitwize ◴[07 Apr 25 20:26 UTC] No.43615593[source]▶
I have no freaking idea. Needless to say I don't think our current operating systems are up to the task of actually being secure. You have to be able to somehow dynamic-link in a library whilst only giving calls into that library certain permissions/capabilities... which I don't think even Windows can do.
replies(4): >>43615767 #>>43615910 #>>43616588 #>>43617962 #
1. izacus ◴[08 Apr 25 02:55 UTC] No.43617962[source]▶
Then maybe your notion of security is useless in the real world and needs a rethink.

Security, when practiced, is a fundamentally practical discipline that needs to work with the world as is, not with dreams of putting people in basements in chains.