Ask HN: Pragmatic way to avoid supply chain attacks as a developer

1. syft

   1 39 6,821 9.8 Go

   CLI tool and library for generating a Software Bill of Materials from container images and filesystems

   

   CycloneDX tools offer packages for each and every programming language. [1]

   The dependency track project accumulates all dependency vulnerabilities in a dashboard. [2]

   Container SBOMs can be generated with syft and grype [3] [4]

   [1] https://github.com/CycloneDX

   [2] https://github.com/DependencyTrack

   [3] https://github.com/anchore/syft

   [4] https://github.com/anchore/grype

2. CodeRabbit

   coderabbit.ai featured

   CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.

   

3. grype

   2 61 9,718 9.7 Go

   A vulnerability scanner for container images and filesystems

   

   CycloneDX tools offer packages for each and every programming language. [1]

   The dependency track project accumulates all dependency vulnerabilities in a dashboard. [2]

   Container SBOMs can be generated with syft and grype [3] [4]

   [1] https://github.com/CycloneDX

   [2] https://github.com/DependencyTrack

   [3] https://github.com/anchore/syft

   [4] https://github.com/anchore/grype

4. l7-devenv

   3 6 25 9.5 JavaScript

   Secure terminal-based IDE for local JS development

   

   A defense-in-depth approach with a special eye to compartmentalization/separation/sandboxing coupled with principle-of-least privilege is a good stance to take, I think. Also keep in mind that "security is a process, not a product". There is no silver bullet no tool will save you from yourself...

   With this in mind:

   - https://qubes-os.org - Use separate VMs for separate domains. Use disposable VMs for temporary sessions.

   - https://github.com/legobeat/l7-devenv - My project. Separate containers for IDE and (ephemeral) code-under-test. Separation of authentication token. Feedback very welcome!

Suggest a related project