Open Source
It seems barely a month goes by without a new supply chain attack making the headlines, and malicious code in dependency packages from package managers such as NPM is a common method. My usual sentiments include “oh another one, what a surprise”, before thoughts eventually turn to - someone *really* ought to be doing something about this. Fortunately, it turns out that quite a few things are indeed being done - there's progress, activity, and promising ideas for the future. The outlook is brighter than what we might have assumed.