LI_S02E47_Tied_up_and_shackled

Linux Inlaws

Content provided by The Linux Inlaws and Linux Inlaws. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by The Linux Inlaws and Linux Inlaws or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

29d ago

MP3•Episode home

Tied up, shackled and then some: In contrast what you may be thinking after this intro, in this episode Martin and Chris take a closer look at an obscure concept known not only in esoteric circles as the software supply chain (chain being the keyword here). Once only appreciated by the inner circle of a small group of level-eight magicians, this concepts has now entered mainstream and is considered instrumental not only in the area creating and maintaining large scale codebases possibly clocking up a few million lines of code. This especially becomes important when a codebase largely relies on FLOSS components commonly downloaded from the internet. Relying on these components may cause a security issue if not handled with caution as not only the recent xz-utils incident (where possibly a nation-state actor) managed to infiltrate a popular compression library virtually used everywhere. So if you're interested in the security of your builds and applications, this is another episode you don't want to miss.

Links

Left-pad incident: https://en.wikipedia.org/wiki/Npm_left-pad_incident
Lucene library: https://lucene.apache.org/core
Open source licenses episode (S01E36): https://archive.org/details/hpr3399
SBOMs: https://about.gitlab.com/blog/the-ultimate-guide-to-sboms
XZ Utils backdoor: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
OpenSSF's tools (not just SBOMs): https://openssf.org/projects
Autotools: https://www.gnu.org/software/automake/manual/html_node/Autotools-Introduction.html
SPDX: https://spdx.dev
CycloneDX: https://cyclonedx.org
valkey-search: https://github.com/valkey-io/valkey-
Thunderbolts: https://www.marvel.com/movies/thunderbolts

149 episodes

#Linux Inlaws #Tech