The Changelog: Software Development, Open Source Securing the open source supply chain (Interview)
Mar 1, 2022
Feross Aboukhadijeh, an open-source developer known for projects like Socket and WebTorrent, joins to discuss the launch of Socket, a tool designed to secure the open-source supply chain. Feross highlights how supply chain attacks have eroded trust in open-source software. He explains Socket’s proactive approach to treating all open-source code as potentially malicious and discusses the alarming prevalence of risks like typo-squatting and package compromises. The conversation sheds light on the collective responsibility needed to enhance security in the tech community.
AI Snips
Chapters
Transcript
Episode notes
Recent Supply Chain Attacks
- The 'colors' and 'faker' packages were compromised, impacting millions of users.
- The 'ua-parser-js' maintainer's password was sold, leading to a significant supply chain attack.
Dependency Risks
- Modern software development relies heavily on dependencies, creating a large attack surface.
- Vulnerability scanners only detect known issues, not malicious intent from compromised packages.
Typosquatting
- Typosquatting involves registering similar package names to trick users.
- The 'browserlist' typo is installed 700,000 times a year, highlighting the risk.