Frontend

What are the best tools for hardening OSS against supply chain attacks?

Design and software at Apple. Also into AI, philosophy of mind, ethics.

Building FOSS via @frames, /open-frames to help decentralized social win. a16z CSX23. farcasterchannels.com farcaster.id

thread https://x.com/brunobar79/status/1389724665338269701?s=46

https://www.npmjs.com/package/audit-ci is nice, sharing more as I search

Snyk is the only tool I've heard about https://snyk.io/series/software-supply-chain-security/attacks/

✨ Founder + CEO Socket (socket.dev) • 🌲 Stanford lecturer (cs253.stanford.edu) • ❤️ Open source at WebTorrent + StandardJS • 🧙‍♂️ Mad scientist

I think the only real defense technically is to slow down updates, create test environments, and avoid pushing anything to the main branch within a two-week or longer time window.