undefined | Better HN

0 pointsTerretta5y ago0 comments

> The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with hardware suppliers you are relying on the security of your vendor.

Not necessarily — plenty software still ships with the third party supply chain bits incorporated as binaries, including commercial software. User is relying on security of one or more in a chain of upstream vendors.

See Cyberpunk 2077 DLLs for instance.

https://twitter.com/CDPRED_Support/status/135660404767189811...

Cyberpunk “builds” their game with a software build system, but not all of it is them building it.

0 comments

tantalor5y ago

Yes, good point of course. Although I would be very suspicious of binary deps served through npm.

j / k navigate · click thread line to collapse

0 pointsTerretta5y ago0 comments

See Cyberpunk 2077 DLLs for instance.

https://twitter.com/CDPRED_Support/status/135660404767189811...

Cyberpunk “builds” their game with a software build system, but not all of it is them building it.