software supply chain
7 posts
Nobody checked what came back
The idTech build did not fail. It resolved a version reference exactly as designed, treating a source's identity as proof of its content's integrity.
The unread binary every compiler still trusts
Translating rustc to C changes the compiler's substrate, not its logic of trust: build pipelines execute on resolved references, never verified content.
Compiling a Rust crate runs the author's code.
crates.io federates all publish identity to GitHub, turning one account takeover into build-time code execution across every downstream Cargo project.
A name is not trust
Package registries resolve a name to an artifact, not a source. When the party behind a trusted name changes, the system inherits trust it cannot verify.
The valet's key still opens your Civic
How a Honda Civic keeps granting access long after the conditions of trust expire, and why reference replaces verification across systems.
Your browser obeys someone else
Chrome disabling uBlock Origin was not a vendor choice to escape but a structure to see: software resolved by reference, executed without revalidating trust.
GitHub-distributed VSCode extension executed unsanctioned code
A board-level brief on the compromised VSCode extension distributed through GitHub: what it exposed, what control did not function, and what must be true.