This is an automated archive made by the Lemmit Bot.

The original was posted on /r/programminglanguages by /u/Smallpaul on 2024-04-03 17:53:10.

Extremely sophisticated people or entities are starting to attack the open source infrastructure in difficult to detect ways.

Should programming languages start to treat dependencies as potentially untrustworthy?

I believe that the SPECIFIC attack was through the build system, and not the programming language, so maybe the ratio of our attention on build systems should increase?

More broadly though, if we can’t trust our dependencies, maybe we need capability-based languages that embody a principle of least privilege?

Of do we need tools to statically analyze what’s going on in our dependencies?

Of do you think that we should treat it 100% as a social, not technical problem?