February 4, 2022
by sjvn01
Comments Off on The Alpha and Omega of software supply chain security
What is the Alpha-Omega Project? Its purpose is to “improve global open source software supply chain security by working with project maintainers to systematically look for new, as-yet-undiscovered vulnerabilities in open-source code” and then fix them. This is vital to improving … Continue reading
February 3, 2022
by sjvn01
Comments Off on Is npm a Hotbed of Malware?
According to WhiteSource, a leading open source security provider, npm, one of the most widely used JavaScript package managers, is a playground for malicious actors. Is it really that bad? First, JavaScript is wildly popular. Love it or hate it, Javascript by Stack Overflow’s … Continue reading
February 1, 2022
by sjvn01
Comments Off on Securing the open source ecosystem: SBOMs are no longer optional
In the last year and a half, one cybersecurity mess after another — the SolarWinds software supply chain attack, the log4j vulnerability, the npm bad code injection — have made it clear that we must clean up our software supply chain. That’s … Continue reading
January 28, 2022
by sjvn01
Comments Off on JFrog Helps Clean up Bad npm JavaScript with 3 New Tools
When Microsoft acquired JavaScript Node package manager (npm) company npm, with its over 1.3 million packages and 75 billion downloads, I’d hoped that some of npm’s notoriously unstable releases would finally be fixed. I hoped in vain. For instance, the recent npm … Continue reading
January 25, 2022
by sjvn01
Comments Off on Will World War III begin in cyberspace?
People die because of cyber wars, even if no bullets are ever fired. Instead, they die in emergency rooms that no longer have power, from broken medical communication networks, and from riots. All of this has happened before. It will … Continue reading
January 21, 2022
by sjvn01
Comments Off on Nasty Linux kernel bug found and fixed
Most reported Linux “security” bugs actually aren’t Linux bugs. For example, security vendor CrowdStrike‘s report on the biggest Linux-based malware families was really about system administration security blunders with telnet, SSH, and Docker, not Linux at all. But, that doesn’t mean Linux doesn’t … Continue reading