Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Common Threats: Supply chain attacks #2467

Merged
merged 1 commit into from
Apr 11, 2024
Merged

Common Threats: Supply chain attacks #2467

merged 1 commit into from
Apr 11, 2024

Conversation

dngray
Copy link
Member

@dngray dngray commented Mar 31, 2024 •
edited
Loading

Changes proposed in this PR:

Closes: #2382

  • I have disclosed any relevant conflicts of interest in my post.
  • I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project.
  • I am the sole author of this work.
  • I agree to the Community Code of Conduct.

dngray added a commit that referenced this pull request Mar 31, 2024
@dngray
Common Threats: Supply chain attacks (#2467)
756a45f
@dngray dngray force-pushed the pr-supply-chain-attack branch from 7f653ef to 756a45f Compare March 31, 2024 09:11
@github-actions GitHub Actions
Copy link

github-actions bot commented Mar 31, 2024 •
edited
Loading

✅ Your preview is ready!

Name Link
🔨 Latest commit 496d2a4
😎 Preview https://2467--glowing-salamander-8d7127.netlify.app/

@dngray dngray added the c:guides full-length guides and content label Mar 31, 2024
@privacyguides-bot
Copy link
Collaborator

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/add-supply-chain-attacks-to-common-threats-page/17595/6

@privacyguides privacyguides deleted a comment from netlify bot Mar 31, 2024
@privacyguides privacyguides deleted a comment from netlify bot Mar 31, 2024
jonaharagon
jonaharagon requested changes Mar 31, 2024
View reviewed changes
Copy link
Member

@jonaharagon jonaharagon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll have to read this tomorrow, but I'll just note quick that new colors should be checked against https://webaim.org/resources/contrastchecker/

@dngray
Copy link
Member Author

dngray commented Apr 1, 2024

Yes i should have marked this as a draft, it might require editorial editing to make it nice.

@dngray dngray mentioned this pull request Apr 2, 2024
Closed
2 tasks
@dngray dngray force-pushed the pr-supply-chain-attack branch from 8e589ea to 566a0ec Compare April 2, 2024 12:55
zyansheep
zyansheep suggested changes Apr 2, 2024
View reviewed changes
Copy link

@zyansheep zyansheep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have some ideas for some small changes :)

docs/basics/common-misconceptions.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
jonaharagon
jonaharagon requested changes Apr 2, 2024
View reviewed changes
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-misconceptions.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated
@@ -57,6 +58,26 @@ By design, **web browsers**, **email clients**, and **office applications** typi

If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://learn.microsoft.com/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user.

<span class="pg-amber">:material-package-variant-closed-remove: Supply Chain</span>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wondering if, instead of placing this here, we add a new section at the bottom of the page: "Advanced Persistent Threats" where we cover larger-scale issues like this. Thoughts?

Copy link
Member Author

@dngray dngray Apr 3, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kind of like that idea, we might find something else to put there in the future.

Copy link
Member Author

@dngray dngray Apr 10, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wondering whether this actually is a good idea at all.

Supply chain attacks don't necessarily have to come from an APT. For example in the case of naming similar nodejs libs that are often typo'ed or uploading some crappy crypto wallet to a store, these are not done by an APT.

APT or not, it really doesn't effect the way the attack is carried out. By putting it under a heading like that we might be insinuating only an APT can pull it off.

@jonaharagon jonaharagon force-pushed the main branch 5 times, most recently from 91e0dc7 to af45bcc Compare April 6, 2024 05:42
dngray added a commit that referenced this pull request Apr 10, 2024
@dngray
Common Threats: Supply chain attacks (#2467)
0cfc981
@dngray dngray force-pushed the pr-supply-chain-attack branch 2 times, most recently from a22ca8d to 40686f3 Compare April 10, 2024 14:47
@dngray dngray requested a review from jonaharagon April 10, 2024 15:49
@jonaharagon jonaharagon force-pushed the main branch 3 times, most recently from 2471612 to 775ff52 Compare April 10, 2024 22:52
jonaharagon pushed a commit that referenced this pull request Apr 11, 2024
@dngray @jonaharagon
Common Threats: Supply chain attacks (#2467)
0d9ee49
@jonaharagon jonaharagon force-pushed the pr-supply-chain-attack branch from 7b1ad13 to 01abb10 Compare April 11, 2024 00:53
dngray added a commit that referenced this pull request Apr 11, 2024
@dngray
Common Threats: Supply chain attacks (#2467)
b12c38c
@dngray dngray force-pushed the pr-supply-chain-attack branch from 01abb10 to c4a5f24 Compare April 11, 2024 05:38
jonaharagon
jonaharagon requested changes Apr 11, 2024
View reviewed changes
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
docs/basics/common-threats.md Outdated Show resolved Hide resolved
dngray added a commit that referenced this pull request Apr 11, 2024
@dngray
Common Threats: Supply chain attacks (#2467)
a668c89
@dngray dngray force-pushed the pr-supply-chain-attack branch from 89962a9 to bef1766 Compare April 11, 2024 09:36
dngray added a commit that referenced this pull request Apr 11, 2024
@dngray
Common Threats: Supply chain attacks (#2467)
496d2a4
@dngray dngray force-pushed the pr-supply-chain-attack branch from bef1766 to 496d2a4 Compare April 11, 2024 09:53
@jonaharagon jonaharagon force-pushed the main branch 2 times, most recently from 0a94f3f to d80af39 Compare April 11, 2024 17:36
@jonaharagon jonaharagon requested a review from freddy-m April 11, 2024 18:02
@jonaharagon jonaharagon force-pushed the pr-supply-chain-attack branch from 496d2a4 to a8a4ade Compare April 11, 2024 18:07
@jonaharagon jonaharagon merged commit a8a4ade into main Apr 11, 2024
13 checks passed
@jonaharagon jonaharagon deleted the pr-supply-chain-attack branch April 11, 2024 18:08
@privacyguides-bot
Copy link
Collaborator

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/2024-04-11/17822/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zyansheep zyansheep zyansheep requested changes

@jonaharagon jonaharagon jonaharagon approved these changes

@freddy-m freddy-m Awaiting requested review from freddy-m

Assignees
No one assigned
Labels
c:guides full-length guides and content
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Footnote example given for "vulnerabilities into even large projects" is not valid/misleading
5 participants
@dngray @privacyguides-bot @jonaharagon @zyansheep @freddy-m