74
Polyfill supply chain attack hits 100K+ sites
(sansec.io)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 25 Jun 2024
74 points (98.7% liked)
Programming
16304 readers
370 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities [email protected]
founded 1 year ago
MODERATORS
You don't believe that income (or lack thereof) can motivate the sale of a popular library to a shady party?
I don't see VLC being bought out.
If you say so... this isn't the first time an underpaid opensource dev sold their project only for it to end up being used for ads or malware.
Anti Commercial-AI license
Not at all what I meant. The premise was that this wouldn’t happen if they were being paid fairly. Supply chain attacks happen with or without fair pay.
Look at what happened with the XZ backdoor. Whether or not they’re getting paid just means a different door is opened.
The root of the problem is that we blindly trust anyone based on name-brand and popularity. That has never in the existence of technology been a reliable nor an effective means of authentication.
If it’s not outright buying out companies it will be vulnerabilities/lack of appropriate management, if it’s not vulns it’ll be insider threat.
These are problems we’ve known about for at least a decade+ and we’ve done fuck all to address the root of the problem.
Never trust, always verify. Simple as that.