Open Source EXPOSED The Trust Crisis in Code!

I actually did want to talk about the XZ Utils attack, where with this kind of socially engineered attack, we had trust but not trustworthiness. And so how are we as an industry going to look at this part of the problem? What comes next here?

Yeah, when you say, like, if you ask every CISO what keeps them up at night, they're probably not thinking about this. But that long game, nation-state level attack is kind of the one that I think keeps me up at night, and a lot of people that care about security for the industry as a whole. That was one where somebody, over a couple of years, established trust in the project. Eventually, the maintainer retired and handed the keys to this person. It turned out it wasn't a person, it was a group of people operating under a fake email address, and they put malware in. Take that one level further, though, right? Just get 3 or 4 people from one of these labs, or Transworkers, just go make a cool open source project. Put it on Twitter, make it useful. You don't even need to take something over. Anyone can put anything on the internet. It's so easy to get GitHub stars for something cool and just spend a couple of years taking user feedback, make the project grow, show up at KubeCon. And then all of a sudden, we're in, right? So I feel like the xzutils brought up some other questions, the push from dev laptop, and also the fact that it was kind of a more long game attack.