There’s also been a regression in how infrastructure is operated.
15 years ago you didn’t let your production infrastructure talk out to the Internet, and if you did, it was via an explicit proxy with allowlisted domains. This significantly limited the damage that a malicious dependency could cause.
With the move to cloud and DevOps, that network security model disappeared.
15 years ago you didn’t let your production infrastructure talk out to the Internet, and if you did, it was via an explicit proxy with allowlisted domains. This significantly limited the damage that a malicious dependency could cause.
With the move to cloud and DevOps, that network security model disappeared.