Not at all what I meant. The premise was that this wouldn’t happen if they were being paid fairly. Supply chain attacks happen with or without fair pay.
Look at what happened with the XZ backdoor. Whether or not they’re getting paid just means a different door is opened.
The root of the problem is that we blindly trust anyone based on name-brand and popularity. That has never in the existence of technology been a reliable nor an effective means of authentication.
If it’s not outright buying out companies it will be vulnerabilities/lack of appropriate management, if it’s not vulns it’ll be insider threat.
These are problems we’ve known about for at least a decade+ and we’ve done fuck all to address the root of the problem.
Not at all what I meant. The premise was that this wouldn’t happen if they were being paid fairly. Supply chain attacks happen with or without fair pay.
Look at what happened with the XZ backdoor. Whether or not they’re getting paid just means a different door is opened.
The root of the problem is that we blindly trust anyone based on name-brand and popularity. That has never in the existence of technology been a reliable nor an effective means of authentication.
If it’s not outright buying out companies it will be vulnerabilities/lack of appropriate management, if it’s not vulns it’ll be insider threat.
These are problems we’ve known about for at least a decade+ and we’ve done fuck all to address the root of the problem.
Never trust, always verify. Simple as that.