An investigation into how software wires global supply chains, and what code conceals.
Socket - Block zero-day supply chain attacks
Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependen...
Dark Code
A few months ago, a founder I know had a data leak that took his security team four days to understand.
Download pumping: New npm deception technique for supply chain attacks
Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.
Cheating is all you need
There is something legendary and historic happening in software engineering, right now as we speak, and yet most of you don't realize at all how big it is.
OpenSourceMalware.com - Community Threat Intelligence
Community-driven threat intelligence. Human-verified supply chain threats from every major open source ecosystem.
Software complexity is a real problem — and your AppSec must factor that in | RL Blog
Software complexity causes a range of challenges. Here are the key problem areas — and how to overcome them with a modern supply chain security approach.
The Firewall.
Big Tech routed me to the loading bay. Not because they're evil. Because we built systems that make human contact a malfunction.
Mercor Data Breach | What You Need to Know
A massive data breach at AI startup Mercor exposes risks in AI supply chains, third-party tools, and data governance. Here’s what security teams need to know.
Everything Is Broken
Once upon a time, a friend of mine accidentally took over thousands of computers. He had found a vulnerability in a piece of software and…
Prospero: a new coding harness for a more civilized age
SGX.Fail
Intel's Software Guard Extension (SGX) promises an isolated execution environment, protected from all software running on the machine. In the past few years, however, SGX has come under heavy fire, threatened by numerous side channel attacks. With Intel repeatedly patching SGX to regain security, we set out to explore the effectiveness of SGX's update mechanisms to prevent attacks on real-world deployments.
How open-source software took over the world | TechCrunch
It was just five years ago that there was an ample dose of skepticism from investors about the viability of open source as a business model. Fast-forward to today and we’ve witnessed the growing excitement in the space.
Cloud Rats and Software Roaches (Idle Words)
We are entering an epoch where it may become easy for small pieces of self-replicating code to permanently infest Internet-connected devices in a way that is hard to undo. Such a world would be annoying to live in and we should take steps to forestall it.
