<story><title>There is no “software supply chain”</title><url>https://iliana.fyi/blog/software-supply-chain/</url></story><parent_chain><item><author>lrvick</author><text>I do software supply chain security consulting for several high risk companies and largely agree with this post that we must stop expecting devs to have any responsibility for code they produce. The responsibility is on those that consume it.&lt;p&gt;This will sound pretty harsh, but if your company chooses to use open source code that does not have capable, paid, full time professionals reviewing it for security and quality, then your company is signing up for that responsibility. If you make no reasonable attempt at vetting your supply chain and harm comes to users as a result, then IMO you should be liable for negligence just like a restaurant serving food with poisonous ingredients. Broadly normalized negligence is still negligence.&lt;p&gt;This should not be controversial, but it is. Washing hands in hospitals was once controversial too but those advocating for it had irrefutable evidence on their side. The medical industry did not want to pay the labor cost of hygiene, and we are seeing the same in the software industry.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.nationalgeographic.com&amp;#x2F;history&amp;#x2F;article&amp;#x2F;handwashing-once-controversial-medical-advice&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.nationalgeographic.com&amp;#x2F;history&amp;#x2F;article&amp;#x2F;handwashi...&lt;/a&gt;&lt;p&gt;Ask yourself if it cheaper to fully review, sign, compile, and maintain third party OSS code or to write something in-house focused on your needs on top of the standard library. Pick one. Both are real options. Some of my clients actually do (or pay others for) security review of every single NPM dependency they use in prod. If you can not afford to review 2000 dependencies then you can not afford 2000 dependencies. Find a leaner path.&lt;p&gt;Companies must stop expecting others to do their software review job for them. OSS devs already wrote the code for free because, ostensibly, it was fun. You are an ass if you ask them to do anything that is not fun, for free, to make your company safer or more money. Such actions make it not fun anymore, and make them stop entirely.&lt;p&gt;I do not know why companies have code review policies for code written by peers, but if the code is 2 million lines of NPM dependencies essentially copy&amp;#x2F;pasted from randos on the internet it is suddenly okay to ship straight to prod and give said randos full control of the data or property of millions of people.&lt;p&gt;We need to start calling this out as the negligence that it is.</text></item></parent_chain><comment><author>deathanatos</author><text>I want to first say: I agree with your comment.&lt;p&gt;I think the problem is that companies &lt;i&gt;would&lt;/i&gt; say &amp;quot;okay, let&amp;#x27;s take the leaner path&amp;quot;; they then proceed to implement their own (say) HTTP library, riddled with bugs which will never get fixed, because it will &lt;i&gt;never&lt;/i&gt; have the same person-hours sunk into it that a (major&amp;#x2F;respectable) FOSS HTTP library will.&lt;p&gt;(And the number of times I&amp;#x27;ve watched a dev attempt to implement some standard while steadfastly refusing to read the standard. Then I proceed to find bug after bug, trivially … because I &lt;i&gt;am&lt;/i&gt; reading the standard…)&lt;p&gt;But you&amp;#x27;re right with your hospital analogy: it&amp;#x27;s that the company does not want to put forth the resources to do the job &lt;i&gt;right&lt;/i&gt;, either by doing it right themselves or by doing the verification work &amp;amp; upstreaming fixes; they&amp;#x27;d rather put forward a bare minimum to do shoddy work.&lt;p&gt;And in all my years of experience, I still am no closer to understanding how to fix that.&lt;p&gt;&amp;gt; &lt;i&gt;We need to start calling this out as the negligence that it is.&lt;/i&gt;&lt;p&gt;People absolutely hate this, IME.</text></comment>
<story><title>There is no “software supply chain”</title><url>https://iliana.fyi/blog/software-supply-chain/</url></story><parent_chain><item><author>lrvick</author><text>I do software supply chain security consulting for several high risk companies and largely agree with this post that we must stop expecting devs to have any responsibility for code they produce. The responsibility is on those that consume it.&lt;p&gt;This will sound pretty harsh, but if your company chooses to use open source code that does not have capable, paid, full time professionals reviewing it for security and quality, then your company is signing up for that responsibility. If you make no reasonable attempt at vetting your supply chain and harm comes to users as a result, then IMO you should be liable for negligence just like a restaurant serving food with poisonous ingredients. Broadly normalized negligence is still negligence.&lt;p&gt;This should not be controversial, but it is. Washing hands in hospitals was once controversial too but those advocating for it had irrefutable evidence on their side. The medical industry did not want to pay the labor cost of hygiene, and we are seeing the same in the software industry.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.nationalgeographic.com&amp;#x2F;history&amp;#x2F;article&amp;#x2F;handwashing-once-controversial-medical-advice&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.nationalgeographic.com&amp;#x2F;history&amp;#x2F;article&amp;#x2F;handwashi...&lt;/a&gt;&lt;p&gt;Ask yourself if it cheaper to fully review, sign, compile, and maintain third party OSS code or to write something in-house focused on your needs on top of the standard library. Pick one. Both are real options. Some of my clients actually do (or pay others for) security review of every single NPM dependency they use in prod. If you can not afford to review 2000 dependencies then you can not afford 2000 dependencies. Find a leaner path.&lt;p&gt;Companies must stop expecting others to do their software review job for them. OSS devs already wrote the code for free because, ostensibly, it was fun. You are an ass if you ask them to do anything that is not fun, for free, to make your company safer or more money. Such actions make it not fun anymore, and make them stop entirely.&lt;p&gt;I do not know why companies have code review policies for code written by peers, but if the code is 2 million lines of NPM dependencies essentially copy&amp;#x2F;pasted from randos on the internet it is suddenly okay to ship straight to prod and give said randos full control of the data or property of millions of people.&lt;p&gt;We need to start calling this out as the negligence that it is.</text></item></parent_chain><comment><author>zmmmmm</author><text>&amp;gt; Companies must stop expecting others to do their job for them. OSS devs already wrote the code for free because, ostensibly, it was fun&lt;p&gt;This is not really true. Open source is &lt;i&gt;much&lt;/i&gt; more than hobbyists doing things in their spare time for fun. A huge amount of open source is developed by and released by paid software professionals as part of their jobs. Some of those companies are directly doing it as part of their actual business offering. Others are doing it because they value owning the mind share in a space. Then, a huge amount of other OSS is developed by people who want to enhance their professional reputations.&lt;p&gt;EDIT: I see the article actually confines itself to OSS software that was written as a hobby. In that case I think my words above are probably out of context. But by the same token, the whole article scope is diluted a lot. Yes, if you have pinned your project on something someone wrote on the weekend for fun with no intention to maintain it, you&amp;#x27;ve got problems. But let&amp;#x27;s not brand all of open source with that problem.</text></comment>