I Am Not a Supplier

I’m a security engineer at a big technology company. I’ve been a security engineer at several of these. I’m speaking for myself here, not for current or previous employers. When I say “software supply chain security”, I am reducing a complex concept to jargon, and am using terms that will evoke specific concepts in the people I work with. I’m not really talking to you; I’m talking to my leaders who are extremely business savvy but may not have the…

About a decade or so ago, I found the way free and open source software was used in commercial projects seemed to better align with the warranty disclaimers of the open source licenses. For example, I remember in a C++ project I worked on back then, every single dependency was committed along with the project. Today this practice is known by the term "vendoring". And, yes, there was no supplier. To illustrate my point, let us consider the case of…

I’ve seen more and more visceral rejection of the notion of “software supply chain” by source contributors. They’re rightly calling out the hypocrisy of companies demanding they be complicit in the supply chain of a product, but not paid or compensated for their works on it. There is no “software supply chain”, only products you didn’t pay for but still expect slave labor to support in perpetuity. On the flip side, I’ve never known a project to reject work while…