wlkr

At this point I would very much like to get off Mr Bones' Wild Ride but I fear this is going to continue to happen because, from my own exploration at least, a large number of commercial detection strategies are directed at the repo/device/developer level when loading/using a package.

This seems analogous to how we tackle email spam and general malware. It means that there is almost always a target valuable enough for bad actors to continue trying. However, unlike email (mostly...), package managers are centralised authorities (and anything out-of-band is surely the developers problem?).

My ill-informed feeling is that we might need to change the culture of lazy versioning with rapid releases and focus on stable, deeply scanned versions at registries. There will be some effect of volume and scale so I could be off, but it still seems telling that this impacts high-churn languages more often.

I don't know, I would love a comprehensive article that explores the landscape right now.

I didn't say it was necessarily more credible, although I understand that was mentioned further up.

Personally I found the article (not the tweets) much more useful to understand the context of all this, as someone very out of the loop. Certianly more useful to me than a long list of very specific, in my option largely LLM output, points about a codebase I'm entirely unfamiliar with with claims that seem to need a legal team and court case to be meaningful. Slop is somewhat unfair and I'm happy to be disagreed with.

This is much better than the current slop post. Could it be swapped, please @dang?

This might just be the frequency illusion at play, but there seem to have been a number of high-profile supply chain attacks of late in major packages. There are several articles on the first few pages of HN right now with different cases.

Looking back ten years to `left-pad`, are there more successful attacks now than ever? I would suspect so, and surely the value of a successful attack has also increased, so are we actually getting better as a broad community at detecting them before package release? It's a complex space, and commercial software houses should do better, but it seems that whilst there are some excellent commercial products (e.g. CI scan tools), generally accessible, idiot friendly tooling is somewhat lacking for projects which start as hobby/amateur code but end up being a dependency in many other projects.

This is a brilliantly accessible study, and ripe for some fun follow-ups. It would be interesting to replicate in other continents and with different species. I suspect the mystery will be readily resolved through hypothesis testing under controlled conditions.