Experimental News Clipping Site

Tag: software supply chain

  • Slashdot: Backdoor in Compromised Solana Code Library Drains $184,000 from Digital Wallets

    —

    by

    system automation
    in

    Source URL: https://news.slashdot.org/story/24/12/05/1848223/backdoor-in-compromised-solana-code-library-drains-184000-from-digital-wallets?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Backdoor in Compromised Solana Code Library Drains $184,000 from Digital Wallets Feedly Summary: AI Summary and Description: Yes Summary: The Solana JavaScript SDK experienced a supply chain attack where malicious code was injected to steal cryptocurrency private keys. This incident highlights the vulnerabilities associated with software supply chains in…

  • Anchore: The Evolution of SBOMs in the DevSecOps Lifecycle: Part 2

    —

    by

    system automation
    in

    Source URL: https://anchore.com/blog/the-evolution-of-sboms-in-the-devsecops-lifecycle-part-2/ Source: Anchore Title: The Evolution of SBOMs in the DevSecOps Lifecycle: Part 2 Feedly Summary: Welcome back to the second installment of our two-part series on “The Evolution of SBOMs in the DevSecOps Lifecycle”. In our first post, we explored how Software Bills of Materials (SBOMs) evolve over the first 4 stages…

  • Microsoft Security Blog: Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON

    —

    by

    system automation
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/ Source: Microsoft Security Blog Title: Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON Feedly Summary: At CYBERWARCON 2024, Microsoft Threat Intelligence analysts will share research and insights on North Korean and Chinese threat actors representing years of threat actor tracking, infrastructure monitoring and disruption, and their attack…

  • Anchore: The Evolution of SBOMs in the DevSecOps Lifecycle: From Planning to Production

    —

    by

    system automation
    in

    Source URL: https://anchore.com/blog/the-evolution-of-sboms-in-the-devsecops-lifecycle/ Source: Anchore Title: The Evolution of SBOMs in the DevSecOps Lifecycle: From Planning to Production Feedly Summary: The software industry has wholeheartedly adopted the practice of building new software on the shoulders of the giants that came before them. To accomplish this developers construct a foundation of pre-built, 3rd-party components together then…

  • Anchore: Choosing the Right SBOM Generator: A Framework for Success

    —

    by

    system automation
    in

    Source URL: https://anchore.com/blog/choose-an-sbom-generation-tool-a-framework/ Source: Anchore Title: Choosing the Right SBOM Generator: A Framework for Success Feedly Summary: Choosing the right SBOM (software bill of materials) generator is tricker than it looks at first glance. SBOMs are the foundation for a number of different uses ranging from software supply chain security to continuous regulatory compliance. Due…

  • Hacker News: Attestations: A new generation of signatures on PyPI

    —

    by

    system automation
    in

    Source URL: https://blog.trailofbits.com/2024/11/14/attestations-a-new-generation-of-signatures-on-pypi/ Source: Hacker News Title: Attestations: A new generation of signatures on PyPI Feedly Summary: Comments AI Summary and Description: Yes Summary: The announcement discusses a new security feature on the Python Package Index (PyPI): index-hosted digital attestations based on PEP 740. This feature enhances package provenance and security by integrating with Trusted…

  • Hacker News: Are We PEP740 Yet?

    —

    by

    system automation
    in

    Source URL: https://trailofbits.github.io/are-we-pep740-yet/ Source: Hacker News Title: Are We PEP740 Yet? Feedly Summary: Comments AI Summary and Description: Yes **Summary:** PEP 740 introduces a standard for cryptographically verifiable attestations for Python packages, ensuring better security and provenance verification through digital signatures. This initiative utilizes Sigstore technology and highlights the significance of trusted identities in safeguarding…

  • Simon Willison’s Weblog: PyPI now supports digital attestations

    —

    by

    system automation
    in

    Source URL: https://simonwillison.net/2024/Nov/14/pypi-digital-attestations/#atom-everything Source: Simon Willison’s Weblog Title: PyPI now supports digital attestations Feedly Summary: PyPI now supports digital attestations Dustin Ingram: PyPI package maintainers can now publish signed digital attestations when publishing, in order to further increase trust in the supply-chain security of their projects. Additionally, a new API is available for consumers and…

  • Hacker News: PyPI now supports digital attestations

    —

    by

    system automation
    in

    Source URL: https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-digital-attestations/ Source: Hacker News Title: PyPI now supports digital attestations Feedly Summary: Comments AI Summary and Description: Yes Summary: PyPI has introduced support for digital attestations, enhancing supply-chain security for Python package maintainers. This update, part of PEP 740, allows maintainers to publish signed attestations associated with their projects, ensuring higher trust and…

  • Anchore: 2024 Software Supply Chain Security Report

    —

    by

    system automation
    in

    Source URL: https://anchore.com/reports/2024-software-supply-chain-security-report/ Source: Anchore Title: 2024 Software Supply Chain Security Report Feedly Summary: The post 2024 Software Supply Chain Security Report appeared first on Anchore. AI Summary and Description: Yes Summary: The text discusses the findings from the 2024 Software Supply Chain Security Report, emphasizing the heightened importance of securing software supply chains amidst…