Crypto exchanges getting drained? Oh noes!
Anyway.
XFEDI
ActivityPubRemote profile
nscur0
Co-Lead of @DependencyTrack.
Maintainer of a bunch of @CycloneDX tooling.
AppSec, supply chain security, bill of materials opinion-haver.
Plant muncher 🌱.
Header image: Carnifex @ Gruenspan Hamburg, Feb 2020
Posts
You know what, never mind. There are other projects with over 37k versions. https://registry.npmjs.org/electron-remote-control
TIL Renovate has almost six thousand(!!!) versions, and the NPM registry's JSON document for it is over 70 MB uncompressed.
What do you mean there's no Slow Horses episode today?
How dependency graphs work (or don't work) seemingly keeps confusing people.
Depending on ecosystem and tooling, users are sometimes led to believe that the graph is indeed a tree, which really matters when you want to give "update component A, then issues in A's transitive dependencies go away, too" advice.
You can't make this verdict from an SBOM dependency graph alone, because the SBOM consumer has no freaking idea how your package manager does version resolution.
Children of Bodom: Oops!... I Did It Again
https://www.youtube.com/watch?v=3XyK2pk2kR8
Timeless classic.
Holy crap, the Serbians really managed to boot out Vucic. Insane.
OTOH, it's probably only a matter of time until someone finds an issue similar to php2shell in the JVM. In which case, well, the level of "we're fucked"-ness will increase to a new level. Until then, sunshine and rainbows.
Turns out the "official" Brotli Java library, org.brotli:dec, which has not seen a public update for *9 years*, is not affected by node2shell/http2shell/brotli4shell/whatever because it's pure Java and not JNDI for once.
If you stayed on the arguably dormant library instead of migrating to newer variants that wrap the Brotli C impl, your next week will look a lot less painful.
One of those weeks were I'm REALLY glad I don't have to do incident response anymore.
I like giving XML shit as much as the next guy, but at least it supports streaming schema validation. With most (all?) JSON schema implementations, you're forced to load it all into memory. Fun times when you get a >300MiB SBOM.