Mastodawn

RE: https://mastodon.social/@7ASecurity/116521920390604616

💪 “urllib3's supply chain posture was described as exceptionally strong, with advanced compliance across SLSA Source, Build, and Provenance requirements. The project maintainers were helpful, responsive, and engaged throughout the audit, ensuring that 7ASecurity had the necessary access and information at all times”

Excellent work @illiav and @quentinpradet! 👏

#security #python #opensource #oss #supplychain #slsa

Show thread

Thomas Fricke (he/his)Apr 16

@slink

https://slsa.dev/

#slsa is the standard

Supply-chain Levels for Software Artifacts

SLSA is a security framework. It is a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises. It’s how you get from safe enough to being as resilient as possible, at any link in the chain.

SLSA

OOTS Apr 7

I had to deal a bit with the "Supply-chain Levels for Software Artifacts" (SLSA) "standard":
https://slsa.dev/

IMO it's a joke, since they do not properly deal with threats from "Includ[ing] a vulnerable dependency (library, base image, bundled file, etc.)". They essentially say "A future version of this standard might deal with that":
https://slsa.dev/spec/v1.2/threats

This has been the main entry point of the past supply chain attacks (XZ backdoor, litellm, Shai-Hulud, ...). A supply-chain security standard that doesn't properly deal with vulnerabilities in dependencies completely misses the point. It's like installing alarms on your windows (to catch burglars trying to enter your home through the windows) when your front door doesn't have a lock.

#SLSA #supplychain #supplychainsecurity #xzbackdoor #ShaiHulud #litellm

Supply-chain Levels for Software Artifacts

SLSA

🅱🅸🅶🅾🆁🆁🅴.🅾🆁🅶 Mar 30

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “METAR SLSA 301300Z 12003KT 9999 FEW007 BKN080 26/24 Q1015” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacumaairport #airport #santaanadelyacuma #bolivia #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Santa Ana Del Yacuma airport (Bolivia) aviation weather and informations SLSA SBL

Aviation weather with TAF and METAR, Maps, hotels and aeronautical information for Santa Ana Del Yacuma airport (Bolivia)

Bigorre.org

Habr Mar 3

Supply Chain Security на примере кофемашины: почему ваш код горчит

Привет, Хабр! Меня зовут Максим Князев, старший системный инженер К2 Кибербезопасность . Сегодня я хочу поговорить об атаках на цепочки поставок на примере того, что все хорошо понимают и любят. Просто представьте, как вы заказываете эспрессо в проверенной кофейне. Зерна от известного обжарщика, бариста с опытом, кофемашина за миллион. И казалось бы, все идеально. Но потом выясняется, что кто-то подсыпал в зерна что-то лишнее еще на плантации. Вы не виноваты, кофейня не виновата, но пить это вы уже не хотите. В разработке происходит ровно то же самое, только в роли зерен здесь выступают npm-пакеты. Плантация превращается в GitHub, а подозрительные примеси представляют собой вредоносный код в легитимном релизе. И вы узнаете о проблемах не по вкусу, а по инциденту в проде. Давайте продолжим это сравнение под катом и разберемся, как не испортить компоненты, из которых складывается современная кибербезопасность.

https://habr.com/ru/companies/k2tech/articles/1004536/

#supply_chain_security #безопасность_цепочки_поставок #sbom #devsecops #open_source #npm #кибербезопасность #уязвимости #slsa #разработка_по

Supply Chain Security на примере кофемашины: почему ваш код горчит

Хабр

Arik Grahl Feb 23

From #ContainerDays London to Barcelona: big thanks to the #DevOps BCN #Meetup for having me!

I revisited my talk on moving beyond imperative #Docker builds toward #Declarative, #Reproducible and #Secure #OCI #Containers with #Nix:
Hermetic, network-isolated builds, clearer dependency graphs, better layer reuse across images, and a stronger supply-chain story (#SBOM + #SLSA provenance).

Slides, transcript and more information at my website: https://www.arik-grahl.de/talks/devops-bcn-february-2026

Photography by @robertspang

HoldMyType Jan 1

#Firefox and Chrome can display fonts differently due to variations in their rendering engines and default settings. If a static page appears with different font sizes or styles, it may be due to browser-specific configurations or #CSS
again I ll ask some questions , which not everyone ll like
should learning a pl be the most critical requirement of #webdevelepment ? i mean a guy can write cool CSS js without having a clue about how browsers or os work
similarly the ability to write #code , what can you do with it without understanding the software supply chain #slsa
or 0 to prod in six weeks , I mean you ll be producing garbage , why waste even 6 weeks #devops
#learntocode is overrated and #reliability is underrated , but what's more underrated is irrationality of the masses
i mean what can you do if they just don't care about the stakes and think they have nothing to lose.

All Things Open Dec 1

🚀 NEW on We ❤️ Open Source 🚀

Electric sheep need defenders. 🐑🔐 Brett Smith explores how SLSA helps secure the software supply chain, translating EO 14028 into a roadmap for resilient pipelines.

Read the article: https://allthingsopen.org/articles/supply-chain-robots-slsa-security

#WeLoveOpenSource #SLSA #FOSS #Cybersecurity #DevSecOps #PolicyAsCode

OpenSSF Nov 26, 2025

🌟 New OpenSSF Project Spotlight 💃

In this interview, SLSA Steering Committee member Tom Hennen (Google) breaks down how SLSA is helping organizations strengthen trust across the software supply chain.

Watch the full Project Spotlight:
🔗 https://www.youtube.com/watch?v=gdYlSuH5Srs

#OpenSSF #SLSA #OSSSecurity