- Jun 2024
-
jentery.github.io jentery.github.io
-
https://web.archive.org/web/20240611050132/https://jentery.github.io/ts200v2/notes.html
An interesting read turning a range of #psts issues into specific reflection questions to ask at the start of a tech project. With references to the background concepts. From 2018. #toread
Vgl [[Techpledge 20190917062614]] as the 'political' phrasing of same.
Tags
Annotators
URL
-
- Apr 2024
-
doublepulsar.com doublepulsar.com
-
This is not the first time an open source package has been hijacked after a maintainer was added – it actually happens all the time in Python repositories and such, and has been one of the leading causes of infostealers and coin miners in development pipelines. It is absolutely not a surprise that somebody is targeting open source compression libraries that systemd loads.. and it is also sadly not a surprise that people online bully the creators of these libraries, either.
Wrt [[XZ open source kwetsbaar door psyops 20240331083508]] and examples referred to here, the author focuses on technology fixes to reduce risks. Whereas most of the problems highlighted are social aspects, for which no other solution is suggested than paying OSS devs who maintain stuff. That may well alleviate some of the social aspects that became an attack surface, but does nothing to look at Q of connections between devs and knitting those into relationships that are more resistant to social engineering and psyops. That and more transparency both on the social side of things and the chains. OSS is open source wrt the piece of software in front of you only.
-