Episode 343 - Stop trying to fix the open source software supply chain

<p dir="auto"><a href="https://twitter.com/joshbressers" rel= "nofollow">Josh</a> and <a href="https://twitter.com/kurtseifried" rel="nofollow">Kurt</a> talk about a blog post that explains there isn't really an open source software supply chain. The whole idea of open source being one thing is incorrect, open source is really a lot of little things put together. A lot of companies and organizations get this wrong.</p> <h2 dir="auto">Show Notes</h2> <ul dir="auto"> <li><a href="https://twitter.com/ilianathewitch" rel= "nofollow">Iliana's Twitter</a></li> <li><a href="https://iliana.fyi/blog/software-supply-chain/" rel= "nofollow">There is no “software supply chain”</a></li> <li><a href="https://iliana.fyi/blog/software-supply-chain/" rel= "nofollow">Google supply chain blog</a></li> <li><a href= "https://github.com/advisories/GHSA-74w3-p89x-ffgh">GitHub ansi_term advisory</a></li> <li><a href= "https://p.datadoghq.com/sb/7dc8b3250-389f47d638b967dbb8f7edfd4c46acb1?from_ts=1663203512414&to_ts=1663808312414&live=true" rel="nofollow">PyPI 2FA Dashboard</a></li> <li><a href= "https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html" rel="nofollow">tarfile issue rediscovered in 2022</a></li> </ul>