In this When Will We Learn post, Drew DeVault talks about supply chain attacks against language package managers (npm, PyPI, cargo, etc…) - and compares them to official Linux distribution repositories (deb, rpm, etc…).
The conclusion drawn was:
The correct way to ship packages is with your distribution’s package manager. These have a separate review step, completely side-stepping typo-squatting, establishing a long-term relationship of trust between the vendor and the distribution packagers, and providing a dispassionate third-party to act as an intermediary between users and vendors. Furthermore, they offer stable distributions which can be relied upon for an extended period of time, provide cohesive whole-system integration testing, and unified patch distribution and CVE notifications for your entire system.
I think I agree with this, essentially. We do need to change the way we do …
Continue reading “Supply Chain Attacks & Package Managers - a Solution?”