no more cubes

Tag: supply chain

  • frequent reminder

    only open source has backdoors.

    commercial, closed source software has undocumented admin features. Eventually forgotten debug tools enabled in production.

  • Malicious PyPI Packages

    It was a matter of time. After the npm-repository was hit later last year and ruby gems were found mining crypto-currency, this times it’s PyPI that spreads bad code. Supply chain attacks, as this vector is typically referred to, becomes an increasing problem. Foremost for software vendors.

    The rich supply of community maintained packages make particular languages attractive to businesses. Plenty of ready made packages allow to rapidly build the most important components required to bootstrap any SaaS business. Authentication, database connectivity, model view abstraction layers, web request routing, html templating, it all can be found in either of these, at no added cost.

    However, nothing in life is free and the price vendors pay is the added risk of unvalidated or unverified sources.

    (more…)