[HN Gopher] Software Supply Chain Security
       ___________________________________________________________________
        
       Software Supply Chain Security
        
       Author : devicu
       Score  : 52 points
       Date   : 2024-04-27 03:31 UTC (19 hours ago)
        
 (HTM) web link (www.devicu.com)
 (TXT) w3m dump (www.devicu.com)
        
       | PurelyApplied wrote:
       | I feel like the header where you define key terms is a space
       | where you really, really want to check for typos.
        
       | burakemir wrote:
       | I had done some "research" to find out the meanings of these
       | terms in the past, so it is really nice to see explanations for
       | all of them listed on one page.
       | 
       | My superficial understanding of the space at large is that there
       | are good initiatives and technical solutions / flexible
       | frameworks but progress depends on various non-technical
       | stakeholder organisations (software consumers, eg governments,
       | hospitals, industry) being able to come together to agree on
       | using these.
       | 
       | The complexity is a big obstacle. It is really the same as with
       | software quality standards or digital identity, there is huge
       | untapped potential that comes from a mismatch between what is
       | possible today and what is usable for "society at large." There
       | is still a long way to go.
        
       | michaelt wrote:
       | Software Supply Chain Security could be a great opportunity for
       | open source developers to get some money out of all the big
       | corporations that benefit from their work.
       | 
       | Bash binaries and source code? Freely available, as always. Bash
       | certificate of origin, needed only by huge corporations for
       | compliance reasons? Available for the low low price of 0.01% of
       | your CEO's total comp.
        
         | dataflow wrote:
         | How would that work for open source? Wouldn't the company just
         | make its own builds?
        
           | alephnerd wrote:
           | Then companies are on the hook for validating and and
           | remediating internal builds of CVEs.
           | 
           | Michaelt is right and it is becoming a major source of
           | revenue for open-core startups (eg. Chainguard)
        
           | lsllc wrote:
           | This is a great idea! If the open sources licenses could be
           | changed (if that's even possible!) such that only the
           | original authors or their designees can create these
           | signatures/attestations, then:
           | 
           | ... If Google really wanted to ship bash (or whatever) with
           | the certs/attestation, they'd have to cough up enough money
           | to make the developer(s) happy. If they don't Google is out
           | of luck, they cannot sign it themselves. So it becomes a
           | tradeoff of how much money the original developer(s) want vs
           | how valuable it is and/or how much it would cost Google to
           | build their own (and thus be able to sign/attest it) if the
           | original developers got too greedy.
           | 
           | AKA a free market software economy!
        
         | xyst wrote:
         | This might be in jest, but this is a pretty good "side gig".
         | Doesn't even have to be offered by the open source maintainers.
         | 
         | Can be offered by anybody. "Hey I can offer full SSCS-2
         | compliance on these open source projects. Only $10K per month!"
        
           | anonymouse008 wrote:
           | "I" I doubt would be allowed in the threat model unless
           | you're someone notable like a patio11 or similar. Otherwise
           | you're just as potentially compromised as the original threat
        
             | qzw wrote:
             | I would think you'd also at least have to be patio11, Inc.,
             | with business liability insurance and documented processes.
             | No individual is going to be trusted by any company that
             | would care about this threat model.
        
               | philsnow wrote:
               | > No individual is going to be trusted by any company
               | that would care about this threat model.
               | 
               | Many (most?) companies _do not care_ about threat models.
               | Rather, for them, security is an exercise in box-ticking
               | so that they can sell to other companies who, in turn,
               | _also_ don 't care about threat models, but who do have
               | stakeholders who want to be told that everything is fine.
               | 
               | There is also the question of what does it mean for a
               | company to care about something or for a company to trust
               | something, really it's decision makers at those companies
               | acting together, and as the number of those people rises,
               | it's easier for them to justify not caring about security
               | if indeed they once did, because of the diffusion of
               | responsibility.
               | 
               | Finally there are the companies that have at least one
               | person who actually cares about security and/or the well-
               | being of their users/customers, who is in a sufficiently
               | powerful position that the _company_ effectively  "cares
               | about security". These are the complement of the "many
               | (most?) companies" in the first sentence.
        
         | mnd999 wrote:
         | Yeah, this has to be the way. Suppliers get paid.
        
         | RcouF1uZ4gsC wrote:
         | > Software Supply Chain Security could be a great opportunity
         | for open source developers to get some money out of all the big
         | corporations that benefit from their work.
         | 
         | I am not so sure about that. The big reason companies get
         | certification is for liability and indemnification.
         | 
         | For the software you are certifying:
         | 
         | Have you paid for a security audit?
         | 
         | Have you obtained certifications for all the open source
         | dependencies of your software?
         | 
         | How much of a bond have you put up?
         | 
         | Do you have legal counsel that can respond to inquiries?
         | 
         | Are you willing to travel to testify in court?
         | 
         | Would you be convincing to a jury of your expertise?
         | 
         | This type of certification plays much more into the hands of
         | someone like Microsoft or Google with their massive size (so
         | they can offer indemnity) their massive in-house legal counsel,
         | and their name recognition.
        
         | kjok wrote:
         | I've been saying that for a while. FOSS maintainers can gain
         | financial independence and sustain their projects by "selling"
         | supply-chain security assurance to consumers on software
         | contents, packaging, etc.
         | 
         | Disclaimer: I'm building a marketplace that would enable this.
        
         | zvr wrote:
         | This is definitely a sound business idea, for anyone (not only
         | the actual developer od the Open Source software) to pursue.
         | 
         | I disagree with the "needed only by huge corporations" part --
         | present and forthcoming regulation will make this needed by
         | everyone doing commercial transactions involving software.
        
           | kjok wrote:
           | Are you referring to federal regulations? Would love to know
           | the details.
        
       | loph wrote:
       | WTF is "Proverence"? I'd call it a typo except it is consistently
       | misspelled.
       | 
       | I think the author means "provenance".
       | 
       | https://www.merriam-webster.com/dictionary/provenance
        
         | thenerdhead wrote:
         | Yep they do. Provenance and especially "build provenance" are
         | what they are referring to but definitely misspell it.
         | 
         | https://slsa.dev/spec/v0.1/provenance
        
       | mistrial9 wrote:
       | interlopers and suspect professions are attracted to a new money
       | source .. In a sea-change series of events that diverge actual
       | authors from new auditors and insert paid control of the forge.
       | In some venn-diagram described process, a few percent of actors
       | will in fact have organic connection to the decades of
       | disciplined work that got us here, and the rest (IMHO) will
       | devolve into the usual suspects of low-rent security,
       | opportunistic money handlers, corporate shills and various forms
       | of government bureaucracies ..
       | 
       | multiple low-effort frat-guy startups already exist immediately..
       | follow-on "experienced" gambling security goons as well (in
       | Ireland for example).
       | 
       | ps- it is crucial to distinguish between the NodeJS disaster
       | zone, javascript in general, at one end.. and core *nix OS parts
       | at the other. not the same conversation
        
         | bjw4 wrote:
         | Could you explain what you mean by "gambling security goons" in
         | Ireland?
        
       | chevman wrote:
       | Many (most?) software supply chain attacks that I have observed
       | in the wild over the last 10 years started with compromised user
       | level credentials, or bad actors with (at the time) legit access.
       | 
       | My current thinking is there are too many ways in to protect
       | yourself with 100% security, so better to spend time figuring out
       | how to reduce the blast radius, and what your recovery protocol
       | will be when you get hit.
        
         | struant wrote:
         | You can also reduce your attack surface (dependencies).
        
       ___________________________________________________________________
       (page generated 2024-04-27 23:02 UTC)