@whitequark @tinker @AndresFreundTec The usual definition of "supply chain" is all the places where you get your code -- whether a contractual relationship exists, as in, say, the SolarWinds attack, or not, as in the current xz attack or the case described below. And consequences for the victims are the same either way, so focusing on having legal paperwork is a distraction, not a defense

https://www.reversinglabs.com/blog/more-malicious-npm-packages-found-in-wake-of-jumpcloud-supply-chain-hack

@rst @tinker @AndresFreundTec that's not the usual definition of a "supply chain"; that's the definition of a "supply chain" that CISOs came up with as an attempt to pawn off their responsibility onto unpaid labor

literally anywhere else your "supply chain" consists of organizations you're paying in exchange for services and labor

@dymaxion @whitequark @rst @tinker @AndresFreundTec understandably, they are pushing against creating a liability relation with OSS maintainers and users in spirit of all those no guarantee clause

Those who are the supply chain of OSS are integrators and commercial entities reselling the software, c.f. CRA in EU

@raito
Why would CISOs want to create a liability relation with entities that by definition have no damn money?

That term is first aimed at internal risk management infrastructure, which understands supply chain risk more generally, to make and communicate the problem and make resources appear. Secondarily, it's aimed at commercial software vendors, who do have money and need to get their shit together. Third, it's a term the security community as a whole uses to think about the problem.

Independent FOSS devs are part of the software supply chain in exactly the way rocks are part of the mineral supply chain, for better and worse.
@whitequark @rst @tinker @AndresFreundTec

@dymaxion @raito @rst @tinker @AndresFreundTec
well, we still have time and labor.

and yep! that last paragraph is exactly the bit I have a problem with. from the perspective of an independent FOSS dev, the whole concept exists to make my life worse with no upside for it. since it doesn't seem like CISOs care about not making my life worse, I see no reason to spend effort acknowledging their motivation; only pushing back against it.

@whitequark
Basically, you get the shitty choice between engaging with the process and working for solutions to the societal problem of FOSS insecurity that take as little effort as possible on your part and actually work, or the world is likely to drop a liability regime in your lap that won't fix the problem but will cost you a lot of time and money.

Because software insecurity is now a society-level concern, and because FOSS insecurity is a nontrivial part of that, opting out isn't an option. Saying that the relationship doesn't exist etc. is just giving up any seat at that table.

Any CISO who isn't an idiot does care about your life getting harder, because they want your work output to exist and while their first priority is the security of their org, their zeroeth priority is the success of their org, which requires FOSS code. Amy CISO who isn't a sociopath puts good outcomes for society before either, which requires a similar balance between insecurity and your life — but even the sociopaths should care. Unfortunately, like executive sociopaths, there are a lot of idiots out there. Giving up your seat still doesn't help.
@raito @rst @tinker @AndresFreundTec