Recent searches

No recent searches

Search options

Only available when logged in.
techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome

Administered by:

Server stats:

4.7K
active users

techhub.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.1

#softwaresupplychain

1 post1 participant1 post today
JAVAPRO<p>Think your code is safe outside the EU? The Brussels Effect says otherwise. Steve Poole breaks down how global laws are converging.</p><p>Don’t wait for fines to find you – read Part 2 now: <a href="https://javapro.io/2025/04/03/move-fast-break-laws-ai-open-source-and-devs-part-2/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">javapro.io/2025/04/03/move-fas</span><span class="invisible">t-break-laws-ai-open-source-and-devs-part-2/</span></a></p><p><a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://mastodon.social/tags/Compliance" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Compliance</span></a> <a href="https://mastodon.social/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevOps</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a></p>
Finite State<p>Loving Reachability Analysis? There’s more to get excited about at Finite State!</p><p>✅ Faster Scan Results <br>✅ Expanded Source Code SCA, now available to all users<br>✅ Streamlined Project &amp; User Administration</p><p>Learn more 👉<a href="https://finitestate.io/request-demo" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">finitestate.io/request-demo</span><span class="invisible"></span></a></p><p><a href="https://mastodon.social/tags/IoTSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IoTSecurity</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a></p>
Finite State<p>Our latest blog shows how to streamline compliance workflows, cut costs, &amp; stay agile, while securing your <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a>.<br>🔗 <a href="https://finitestate.io/blog/unified-sdf-cybersecurity-compliance" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">finitestate.io/blog/unified-sd</span><span class="invisible">f-cybersecurity-compliance</span></a></p><p>Plus, join our webinar to learn how to operationalize security across the product lifecycle 👉 <a href="https://info.finitestate.io/securing-the-product-lifecycle" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">info.finitestate.io/securing-t</span><span class="invisible">he-product-lifecycle</span></a></p>
JAVAPRO<p>What’s in your stack—and who’s accountable for it? In 2025, “I didn’t know” won’t fly. Steve Poole dives into <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a>, OSS &amp; the new rules of responsibility.</p><p>Start with part 1 of his 4-part series—stay ahead: <a href="https://javapro.io/2025/04/01/move-fast-break-laws-ai-open-source-and-devs-part-1/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">javapro.io/2025/04/01/move-fas</span><span class="invisible">t-break-laws-ai-open-source-and-devs-part-1/</span></a></p><p><a href="https://mastodon.social/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevOps</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://mastodon.social/tags/DevLife" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevLife</span></a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a></p>
Syft<p>The team was busy shipping last week! 🚢 While Grype got some new scanners, Syft got quality-of-life improvements for enterprise users and better SPDX handling. A rising tide lifts all boats!<br>See what we were up to: <a href="https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-24-2025/457" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">anchorecommunity.discourse.gro</span><span class="invisible">up/t/anchore-open-source-weekly-report-week-24-2025/457</span></a> <br><a href="https://fosstodon.org/tags/SBOM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SBOM</span></a> <a href="https://fosstodon.org/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://fosstodon.org/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a></p>
Finite State<p>On June 12th, Matt will be joining a panel at IMC's IoT Days Summer Conference to discuss how global manufacturers can operationalize security throughout the software supply chain.</p><p>Reserve your spot <a href="https://www.bigmarker.com/horizon-house-publications/track-3-security-by-design-default-breach-defense-as-embedded-concept?utm_bmcr_source=fst" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bigmarker.com/horizon-house-pu</span><span class="invisible">blications/track-3-security-by-design-default-breach-defense-as-embedded-concept?utm_bmcr_source=fst</span></a></p><p><a href="https://mastodon.social/tags/IoTSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IoTSecurity</span></a> <a href="https://mastodon.social/tags/SecureByDefault" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecureByDefault</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a></p>
Finite State<p>Dario &amp; Tim will be at <a href="https://mastodon.social/tags/InfosecurityEurope" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfosecurityEurope</span></a> June 3–5 — no booth, just real convos.</p><p>Want to talk SBOMs, IoT security, or CRA prep? Look out for them on the conference floor</p><p><a href="https://mastodon.social/tags/IoTSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IoTSecurity</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://mastodon.social/tags/EUCRA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EUCRA</span></a> <a href="https://mastodon.social/tags/CyberResilience" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberResilience</span></a></p>
Brian Greenberg :verified:<p>🚨 Critical alert for developers &amp; security teams! 🚨</p><p>Over 70 malicious npm &amp; VS Code packages have been uncovered, targeting developers by:</p><p>🐍 Embedding data- &amp; crypto-stealing scripts<br>🐱‍💻 Exploiting helper libraries &amp; legitimate-looking extensions<br>⚡ Using advanced obfuscation, Discord webhooks, &amp; multi-stage payloads<br>💥 Even sneaking malware through browser extensions + phishing chains</p><p>This highlights why software supply chain security is no longer optional — attackers are innovative, patient, and increasingly targeting developers’ environments.</p><p>If you use npm, VS Code, or build in Solidity, audit your environments now. Stay ahead with continuous monitoring, threat intelligence, and team awareness.</p><p>How is your org strengthening its supply chain defenses?</p><p><a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>npm</span></a> <a href="https://infosec.exchange/tags/VSCode" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VSCode</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a></p><p><a href="https://thehackernews.com/2025/05/over-70-malicious-npm-and-vs-code.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2025/05/over</span><span class="invisible">-70-malicious-npm-and-vs-code.html</span></a></p>
Finite State<p>As <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> attacks rise, verifying <a href="https://mastodon.social/tags/SBOM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SBOM</span></a> quality is vital to identifying hidden risks, managing 3rd-party dependencies &amp; meeting global compliance standards. Catch up on Beecham Research's webinar to learn what good looks like &amp; why it matters<br><a href="https://beecham-research.webinargeek.com/securing-enterprise-iot?cst=as" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">beecham-research.webinargeek.c</span><span class="invisible">om/securing-enterprise-iot?cst=as</span></a></p>
Finite State<p>Matt will be on the panel "Security by Design/Default: Breach Defense as Embedded Concept" at <a href="https://mastodon.social/tags/IMC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IMC</span></a>'s IoT Days Summer event (June 12th), joining the conversation on how global leaders are embedding resilience into the <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a>. </p><p>Don't miss it! <a href="https://www.bigmarker.com/horizon-house-publications/track-3-security-by-design-default-breach-defense-as-embedded-concept?utm_bmcr_source=fst" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bigmarker.com/horizon-house-pu</span><span class="invisible">blications/track-3-security-by-design-default-breach-defense-as-embedded-concept?utm_bmcr_source=fst</span></a></p>
ActiveState<p>Open-source vulnerabilities keeping you up at night? 😬 ActiveState’s platform is here to help. From proactive risk prioritization to precision remediation, we make managing open-source security simple, scalable, and effective.</p><p>🎥 Watch our latest video to see how we reduce open-source risks: <a href="https://www.activestate.com/resources/videos/reduce-open-source-risk/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">activestate.com/resources/vide</span><span class="invisible">os/reduce-open-source-risk/</span></a></p><p><a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.social/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://mastodon.social/tags/RiskManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RiskManagement</span></a></p>
Finite State<p>📢 IoT cybersecurity is now a boardroom priority.</p><p>Matt joined @BeechamResearch &amp; Aeris to unpack the latest in <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> security—from global regs like EU CRA to why SBOMs &amp; visibility are non-negotiable 👉 <a href="https://finitestate.io/blog/bridging-iot-security-gap-webinar-summary" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">finitestate.io/blog/bridging-i</span><span class="invisible">ot-security-gap-webinar-summary</span></a></p><p><a href="https://mastodon.social/tags/IoTSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IoTSecurity</span></a> <a href="https://mastodon.social/tags/ProductSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ProductSecurity</span></a></p>
JAVAPRO<p>Global software, local laws. Part 4 of Steve Poole’s series dives into export controls <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> liability &amp; compliance in a divided world. Regional hosting, risk audits &amp; readiness matter more than ever.<br>👉Read: <a href="https://javapro.io/2025/04/10/move-fast-break-laws-ai-open-source-and-devs-part-4/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">javapro.io/2025/04/10/move-fas</span><span class="invisible">t-break-laws-ai-open-source-and-devs-part-4/</span></a></p><p><a href="https://mastodon.social/tags/AIRegulation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AIRegulation</span></a> <a href="https://mastodon.social/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevOps</span></a> <a href="https://mastodon.social/tags/Java" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Java</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a></p>
Deutschland<p><a href="https://www.europesays.com/de/97674/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">europesays.com/de/97674/</span><span class="invisible"></span></a> Remote-Access-Trojaner in npm-Paket mit 40.000 wöchentlichen Downloads gefunden <a href="https://pubeurope.com/tags/Deutschland" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Deutschland</span></a> <a href="https://pubeurope.com/tags/Germany" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Germany</span></a> <a href="https://pubeurope.com/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IT</span></a> <a href="https://pubeurope.com/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>JavaScript</span></a> <a href="https://pubeurope.com/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>npm</span></a> <a href="https://pubeurope.com/tags/paketmanager" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>paketmanager</span></a> <a href="https://pubeurope.com/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://pubeurope.com/tags/Science" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Science</span></a> <a href="https://pubeurope.com/tags/Science" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Science</span></a>&amp;Technology <a href="https://pubeurope.com/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> <a href="https://pubeurope.com/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://pubeurope.com/tags/Softwareentwicklung" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Softwareentwicklung</span></a> <a href="https://pubeurope.com/tags/SupplyChainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChainSecurity</span></a> <a href="https://pubeurope.com/tags/Technik" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Technik</span></a> <a href="https://pubeurope.com/tags/Technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Technology</span></a> <a href="https://pubeurope.com/tags/Trojaner" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Trojaner</span></a> <a href="https://pubeurope.com/tags/Wissenschaft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wissenschaft</span></a> <a href="https://pubeurope.com/tags/Wissenschaft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wissenschaft</span></a>&amp;Technik</p>
ActiveState<p>What’s shaping the future of cybersecurity in 2025? ActiveState’s insights from RSA reveal critical trends in open-source security and software supply chain resilience. From compliance to proactive threat mitigation, these takeaways are a must-read for security professionals and developers alike.</p><p>🔗 Read the blog: <a href="https://www.activestate.com/blog/learnings-top-security-trends-from-activestate-at-rsa-2025/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">activestate.com/blog/learnings</span><span class="invisible">-top-security-trends-from-activestate-at-rsa-2025/</span></a></p><p><a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChain</span></a> <a href="https://mastodon.social/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://mastodon.social/tags/RSAC2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RSAC2025</span></a> <a href="https://mastodon.social/tags/ApplicationSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ApplicationSecurity</span></a></p>
Colan Schwartz<p>Until these tools learn how to properly trust sources, check them yourself, and ensure their trustworthiness before using them. </p><p>I'm wondering if some kind of trust ecosystem could work here, though? It wouldn't be hard for the AIs to verify digital signatures, right?</p><p><a href="https://arstechnica.com/security/2025/04/ai-generated-code-could-be-a-disaster-for-the-software-supply-chain-heres-why/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">arstechnica.com/security/2025/</span><span class="invisible">04/ai-generated-code-could-be-a-disaster-for-the-software-supply-chain-heres-why/</span></a></p><p><a href="https://mastodon.social/tags/supplychainsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>supplychainsecurity</span></a> <a href="https://mastodon.social/tags/supplychainattack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>supplychainattack</span></a> <a href="https://mastodon.social/tags/LLMs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LLMs</span></a> <a href="https://mastodon.social/tags/factchecking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>factchecking</span></a> <a href="https://mastodon.social/tags/softwaresupplychain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>softwaresupplychain</span></a> <a href="https://mastodon.social/tags/SoftwareSupplyChainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChainSecurity</span></a> <a href="https://mastodon.social/tags/ai" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ai</span></a> <a href="https://mastodon.social/tags/packagemanagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>packagemanagement</span></a> <a href="https://mastodon.social/tags/weboftrust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>weboftrust</span></a> <a href="https://mastodon.social/tags/factchecking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>factchecking</span></a> <a href="https://mastodon.social/tags/digitalsignatures" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>digitalsignatures</span></a></p>
TrendingLive feeds
About