home.social

#supplychainsecurity — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #supplychainsecurity, aggregated by home.social.

  1. Debian 14 Forky is mandating bit-for-bit identical builds to stop supply chain attacks. Discover how this shifts trust from servers to auditable source code.

    More details here: ostechnix.com/debian-linux-rep

    #Debian14 #DebianForky #ReproducibleBuilds #Security #Linux #Packages #SupplyChainSecurity

  2. OSSGuard — one CLI to scan your project and tell you exactly which OpenSSF security practices are missing: Scorecard, SLSA, SBOM, Sigstore, and more.

    Works with Python, Go, JS, Rust, Java, C/C++.

    pip install ossguard
    brew install kirankotari/tap/ossguard
    npx ossguard

    github.com/kirankotari/ossguard

    #OpenSSF #SupplyChainSecurity #DevSecOps #OpenSource #DevOps #Python #Node #Golang #Community

  3. Palantir Technologies secures $300 million USDA contract to enhance U.S. farmland management and food security amid global supply chain threats and growing concerns over foreign agricultural land acquisitions, marking the company's expansion beyond defense sector into civilian government agencies.
    #YonhapInfomax #PalantirTechnologies #USDA #FoodSecurity #FarmlandManagement #SupplyChainSecurity #Economics #FinancialMarkets #Banking #Securities #Bonds #StockMarket
    en.infomaxai.com/news/articleV

  4. Palantir Technologies secures $300 million USDA contract to enhance U.S. farmland management and food security amid global supply chain threats and growing concerns over foreign agricultural land acquisitions, marking the company's expansion beyond defense sector into civilian government agencies.
    #YonhapInfomax #PalantirTechnologies #USDA #FoodSecurity #FarmlandManagement #SupplyChainSecurity #Economics #FinancialMarkets #Banking #Securities #Bonds #StockMarket
    en.infomaxai.com/news/articleV

  5. 🚨 Emergency DevSec Station drop.
    There's an active npm supply chain attack happening right now. Compromised packages are stealing SSH keys, AWS credentials, GitHub tokens, browser passwords, and crypto wallets on install. Then using your publish token to infect every package you maintain.
    One command can protect you immediately: npm config set ignore-scripts true
    Do it today, please. Tell your team. Watch the full 60 seconds.
    #AppSec #SupplyChainSecurity #DevSecOps #SecureCoding #npm

  6. I'm on Fallthrough: Supply Chain Reaction

    Announcing my appearance as a guest co-host on Fallthrough, talking about supply chain security, AI, Claude Mythos, and many more topics.

    fed.brid.gy/r/https://www.jvt.

  7. I'm on Fallthrough: Supply Chain Reaction

    Announcing my appearance as a guest co-host on Fallthrough, talking about supply chain security, AI, Claude Mythos, and many more topics.

    fed.brid.gy/r/https://www.jvt.

  8. I'm on Fallthrough: Supply Chain Reaction

    Announcing my appearance as a guest co-host on Fallthrough, talking about supply chain security, AI, Claude Mythos, and many more topics.

    fed.brid.gy/r/https://www.jvt.

  9. I'm on Fallthrough: Supply Chain Reaction

    Announcing my appearance as a guest co-host on Fallthrough, talking about supply chain security, AI, Claude Mythos, and many more topics.

    fed.brid.gy/r/https://www.jvt.

  10. I'm on Fallthrough: Supply Chain Reaction

    Announcing my appearance as a guest co-host on Fallthrough, talking about supply chain security, AI, Claude Mythos, and many more topics.

    fed.brid.gy/r/https://www.jvt.

  11. Laser-based hardware attacks are only for nation-state actors with million-dollar labs. Right?
    Wrong.
    At BSides312, Larry Trowell and Sam Beaumont (PANTH13R) from NetSPI built affordable laser tools using an open-source microscope and consumer-grade lasers to detect hardware malware and supply chain chip swaps.
    Hackers go pew pew.
    May 16th. Chicago.
    🎟️ bsides312.org
    #BSides312 #InfoSec #HardwareHacking #SupplyChainSecurity #CyberSecurity #Chicago #BSides #THOTCON

  12. I had to deal a bit with the "Supply-chain Levels for Software Artifacts" (SLSA) "standard":
    slsa.dev/

    IMO it's a joke, since they do not properly deal with threats from "Includ[ing] a vulnerable dependency (library, base image, bundled file, etc.)". They essentially say "A future version of this standard might deal with that":
    slsa.dev/spec/v1.2/threats

    This has been the main entry point of the past supply chain attacks (XZ backdoor, litellm, Shai-Hulud, ...). A supply-chain security standard that doesn't properly deal with vulnerabilities in dependencies completely misses the point. It's like installing alarms on your windows (to catch burglars trying to enter your home through the windows) when your front door doesn't have a lock.

    #SLSA #supplychain #supplychainsecurity #xzbackdoor #ShaiHulud #litellm

  13. Addressing the #LiteLLM supply chain incident:

    All #SakuraSky managed production environments are unaffected by the v1.82.7/8 compromise.

    Our infrastructure is a "Zero-Value Target." Using #OIDC and Just-in-Time key injection, we ensure that even if a library is breached, it finds an "empty room"- no static keys or .env files to steal.

    We’re also accelerating our Sentinel framework for deeper AI agent governance.

    Details: sakurasky.com/blog/security-ad

    #InfoSec #AI #SupplyChainSecurity #DevSecOps

  14. With cyber-physical systems (CPS) becoming increasingly central to logistics, supply chains, and industrial operations, protecting them goes beyond traditional IT security. 🌐 It requires a holistic approach that bridges #IT and #OT, providing full visibility, prioritizing risk, and ensuring operational continuity.

    🔖 Our latest blog explores how Claroty helps organizations safeguard the CPS that power global supply chains. Read here: claroty.com/blog/protecting-th

    #CyberPhysicalSystems #OTSecurity #SupplyChainSecurity #CyberResilience #IndustrialCybersecurity

  15. Autonomous robots are already on our streets. AI drones are already on the battlefield. But who actually controls them — and what happens when a hostile state flips the switch?

    My latest article explores the uncomfortable truth about autonomous systems. Read the full article on my blog.

    axelsegebrecht.com/posts/2026-

    #Cybersecurity #SupplyChainSecurity #AutonomousSystems #AIGovernance #NationalSecurity

  16. Supply chain security meets reproducible builds.
    ExpressVPN is sponsoring PlanetNix 2026, highlighting the intersection of privacy, open-source infrastructure, and build reproducibility.
    Event focus areas:
    • Deterministic builds
    • Secure deployment pipelines
    • DevSecOps integration
    • Team-level onboarding models
    • Production-grade Nix environments

    Reproducibility is increasingly tied to:
    – Software supply chain integrity
    – Auditability
    – Compliance frameworks
    – Infrastructure security baselines
    As build determinism becomes more relevant to threat modeling, open-source tooling like Nix may play a critical role.

    Source: planetnix.com/

    Are reproducible systems now essential for modern security architecture?

    Engage in the comments.
    Follow TechNadu for high-signal infosec reporting.
    Repost to amplify open-source security discussions.

    #Infosec #DevSecOps #SupplyChainSecurity #ReproducibleBuilds #NixOS #OpenSourceSecurity #ExpressVPN #CloudSecurity #InfrastructureSecurity #ThreatModeling

  17. Supply chain security meets reproducible builds.
    ExpressVPN is sponsoring PlanetNix 2026, highlighting the intersection of privacy, open-source infrastructure, and build reproducibility.
    Event focus areas:
    • Deterministic builds
    • Secure deployment pipelines
    • DevSecOps integration
    • Team-level onboarding models
    • Production-grade Nix environments

    Reproducibility is increasingly tied to:
    – Software supply chain integrity
    – Auditability
    – Compliance frameworks
    – Infrastructure security baselines
    As build determinism becomes more relevant to threat modeling, open-source tooling like Nix may play a critical role.

    Source: planetnix.com/

    Are reproducible systems now essential for modern security architecture?

    Engage in the comments.
    Follow TechNadu for high-signal infosec reporting.
    Repost to amplify open-source security discussions.

    #Infosec #DevSecOps #SupplyChainSecurity #ReproducibleBuilds #NixOS #OpenSourceSecurity #ExpressVPN #CloudSecurity #InfrastructureSecurity #ThreatModeling

  18. Supply chain security meets reproducible builds.
    ExpressVPN is sponsoring PlanetNix 2026, highlighting the intersection of privacy, open-source infrastructure, and build reproducibility.
    Event focus areas:
    • Deterministic builds
    • Secure deployment pipelines
    • DevSecOps integration
    • Team-level onboarding models
    • Production-grade Nix environments

    Reproducibility is increasingly tied to:
    – Software supply chain integrity
    – Auditability
    – Compliance frameworks
    – Infrastructure security baselines
    As build determinism becomes more relevant to threat modeling, open-source tooling like Nix may play a critical role.

    Source: planetnix.com/

    Are reproducible systems now essential for modern security architecture?

    Engage in the comments.
    Follow TechNadu for high-signal infosec reporting.
    Repost to amplify open-source security discussions.

    #Infosec #DevSecOps #SupplyChainSecurity #ReproducibleBuilds #NixOS #OpenSourceSecurity #ExpressVPN #CloudSecurity #InfrastructureSecurity #ThreatModeling

  19. Supply chain security meets reproducible builds.
    ExpressVPN is sponsoring PlanetNix 2026, highlighting the intersection of privacy, open-source infrastructure, and build reproducibility.
    Event focus areas:
    • Deterministic builds
    • Secure deployment pipelines
    • DevSecOps integration
    • Team-level onboarding models
    • Production-grade Nix environments

    Reproducibility is increasingly tied to:
    – Software supply chain integrity
    – Auditability
    – Compliance frameworks
    – Infrastructure security baselines
    As build determinism becomes more relevant to threat modeling, open-source tooling like Nix may play a critical role.

    Source: planetnix.com/

    Are reproducible systems now essential for modern security architecture?

    Engage in the comments.
    Follow TechNadu for high-signal infosec reporting.
    Repost to amplify open-source security discussions.

    #Infosec #DevSecOps #SupplyChainSecurity #ReproducibleBuilds #NixOS #OpenSourceSecurity #ExpressVPN #CloudSecurity #InfrastructureSecurity #ThreatModeling

  20. Supply chain security meets reproducible builds.
    ExpressVPN is sponsoring PlanetNix 2026, highlighting the intersection of privacy, open-source infrastructure, and build reproducibility.
    Event focus areas:
    • Deterministic builds
    • Secure deployment pipelines
    • DevSecOps integration
    • Team-level onboarding models
    • Production-grade Nix environments

    Reproducibility is increasingly tied to:
    – Software supply chain integrity
    – Auditability
    – Compliance frameworks
    – Infrastructure security baselines
    As build determinism becomes more relevant to threat modeling, open-source tooling like Nix may play a critical role.

    Source: planetnix.com/

    Are reproducible systems now essential for modern security architecture?

    Engage in the comments.
    Follow TechNadu for high-signal infosec reporting.
    Repost to amplify open-source security discussions.

    #Infosec #DevSecOps #SupplyChainSecurity #ReproducibleBuilds #NixOS #OpenSourceSecurity #ExpressVPN #CloudSecurity #InfrastructureSecurity #ThreatModeling

  21. @cpansec published a 2025 year in review!

    We had lots of activities, and good progress in many places, but can do more.

    Check it out, and if you feel inspired, join us!

    security.metacpan.org/2026/01/

  22. 🔐 Third-Party Risk Management at RELIANOID

    At RELIANOID, security and resilience extend beyond our own platform. We apply strict Third-Party Risk Management (TPRM) practices to ensure that every vendor, partner, or supplier meets our high standards for security, compliance, and reliability.

    More details: relianoid.com/security-complia