Live and recent posts from across the Fediverse tagged #supplychainsecurity, aggregated by home.social.
US Transportation Department Deploys AI to Vet Grant Applicants for Adversarial Ties
The US Transportation Department is leveraging AI to scrutinize grant applicants, digging deep to uncover any potential ties to adversarial entities like the Chinese Communist Party or Russian oligarchs. This cutting-edge vetting process helps ensure that promising research projects receive…
#ArtificialIntelligence #GrantVetting #SupplyChainSecurity #NationalSecurity #Transportation
Signing releases sits on the list for years looking bigger than it is. Key management has a reputation.
So skip that part for now. Spend ten minutes with a throwaway key on your own machine, where the worst outcome is deleting a directory afterwards.
The walkthrough:
→ generate an RSA 4096 keypair with sigillum
→ sign a checksum manifest
→ verify it with gpg, an implementation that isn't the signer
→ tamper with the file and watch "Good signature" turn into "BAD signature"
That last step is the point. A verification you have never seen fail is one you are taking on faith.
It uses the local backend, a private key on disk. Fine for learning, emphatically wrong for a real release: production wants KMS, where the private half never leaves the service.
Every command and output was run against v0.5.3 with GnuPG 2.4.4.
Akamai reveals the CodeAudit AI extension and VS Code CodeAudit AIextension upload pasted source code and metadata over unencrypted HTTP.
#CodeAuditAI #VSCode #Cybersecurity #AISecurity #MalwareAnalysis #SupplyChainSecurity #InfoSec
GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.
#npm #TrustedPublishing #GitHub #GitHubActions #SupplyChainSecurity #OIDC #OpenSource #DevSecOps
https://securityonline.info/npm-trusted-publishing/?utm_source=mastodon&utm_medium=jetpack_social
Polish prosecutors concluded NSO Group retained technical access to the Pegasus system operated by Poland's Central Anti-Corruption Bureau. The finding raises sovereignty and supply-chain risks, as a foreign vendor could access sensitive operational data. #Pegasus #Poland #SupplyChainSecurity
https://cyberworldops.eu/en/polish-probe-says-nso-retained-technical-access-to-poland-s-pegasus