• 0 Posts
  • 428 Comments
Joined 2 years ago
cake
Cake day: July 14th, 2023

help-circle


















  • Depends on the use case, and what you mean by “external dependencies”.

    Black box remote services you’re invoking over HTTP, or source files that are available for inspection and locked by their hash so their contents don’t change without explicit approval?

    Cuz I’ll almost entirely agree on the former, but almost entirely disagree on the latter.

    In my career:

    I’ve seen multiple vulns introduced by devs hand-writing code that doesn’t follow best practices while there were packages available that did.

    I have not yet seen a supply chain attack make it to prod.

    The nice thing about supply chain attacks though: they get publicly disclosed. Your intern’s custom OAuth endpoint that leaks the secret? Nobody’s gonna tell you about that.