Episode 541: Jordan Harband and Donald Fisher on Securing the Supply Chain
Topics covered
Popular Clips
Episode Highlights
Vulnerabilities
Open source software presents unique vulnerabilities within the supply chain due to its widespread use and inherent transparency. highlights that while open source benefits from the "many eyes" principle, its extensive use means that any compromise can have vast implications 1. adds that even minor bugs can cause widespread issues, as seen when a simple error message change affected users globally 1.
When you have a shared piece of infrastructure and that shared piece has problems, you see the impact of those problems spread much more widely.
---
The challenge lies in managing the scale of dependencies, which often include code that developers haven't written or audited themselves 2.
Security Efforts
Efforts to enhance open source security are gaining momentum, with initiatives like the OpenSSF Security Scorecards project leading the way. explains that these projects aim to establish best practices for secure software development, involving both corporate and independent creators 3. emphasizes the need for financial investment to sustain these efforts, noting that the tech industry often treats open source as free labor 4.
If you want open source software to be more secure, spend money, put money towards it, and or regulate it.
---
The collaboration between organizations and individual developers is crucial for transforming security wish lists into reality 3.