Daily Edition · Page 2

THE DAILY INDEX

Technology, AI, software, security, crypto and business

PROGRAMMING, DESIGN & DATA SCIENCE

TLDR

GITHUB ACTIONS IS THE WEAKEST LINK

Almost every open source supply chain incident from the past eighteen months involves GitHub Actions features behaving exactly as documented. Actions is basically a package manager with no lockfile, no integrity hashes, and no transitive visibility. The whole product is a collection of features that are convenient, but very easy to assemble into something dangerous. GitHub plans to add fixes, but the company says that changing the defaults will break existing workflows.

TLDR IndexPage 2