News: 0000821092

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

A review of open-source software supply chain attacks

([Security] May 21, 2020 14:13 UTC (Thu) (corbet))


Here's [1]a preprint paper from Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier looking at attacks on language-specific repositories. " Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions. "



[1] https://arxiv.org/abs/2005.09535

ELECTRIC JELL-O

2 boxes JELL-O brand gelatin 2 packages Knox brand unflavored gelatin
2 cups fruit (any variety) 2+ cups water
1/2 bottle Everclear brand grain alcohol

Mix JELL-O and Knox gelatin into 2 cups of boiling water. Stir 'til
fully dissolved.
Pour hot mixture into a flat pan. (JELL-O molds won't work.)
Stir in grain alcohol instead of usual cold water. Remove any congealing
glops of slime. (Alcohol has an unusual effect on excess JELL-O.)
Pour in fruit to desired taste, and to absorb any excess alcohol.
Mix in some cold water to dilute the alcohol and make it easier to eat for
the faint of heart.
Refrigerate overnight to allow mixture to fully harden. (About 8-12 hours.)
Cut into squares and enjoy!

WARNING:
Keep ingredients away from open flame. Not recommended for
children under eight years of age.