Hacker News Reader

Comment by raesene9 | Hacker News Reader

Interesting post and illustrative of some of the problems with supply chain security.

The more layers of abstraction and packaging that are added the harder it becomes for end-users to see what's going on.

One of the big problems is stale packages not keeping all the layers under them updated. This problem is likely to get worse as time goes by, as people move on from projects and things become unmaintained.

One option is to fork the packaging at one level and then take on maintenance yourself (e.g. creating/maintaining docker images) but then ofc you have all the work of doing that yourself.

Another option (in theory) could be someone selling a service of maintained, updated, scanned images/helm charts, but I've not seen previous efforts in this area be hugely successful...

hopefully the OSSF will come up with some good solutions in this space, but it's fundamentally a time consuming thing to fix and maintain.

View on HN

“ Another option (in theory) could be someone selling a service of maintained, updated, scanned images/helm charts”

This is what we aim for with Tanzu Application Catalog https://tanzu.vmware.com/application-catalog

We still have a lot of work to do but you can do things like providing your own base image that you customize and maintain to your specs and we build and test the apps on top of it

For those who aren't aware, Tanzu Application Catalog is a descendant of work done by Bitnami to build and curate OSS.

Disclosure: I work for VMware, but not on this.

That seems to be an interesting product. However looking at the price [0] that is probably not an option for everyone:

> The Team Edition is priced at $150,000 per year. The Org Edition is priced at $995,000 per year

[0]: https://docs.bitnami.com/tanzu-application-catalog/faq/get-s...

Here I rush to add that I also don't work on pricing and packaging.

Yes this is mostly an offering oriented towards enterprises. There is a new offering coming soon at a lower price point

That's really interesting and I hope it'll be successful, it'd be great to see more solutions tackle this area. I guess starting with an entperise price point, means you can hopefully get a revenue level to help widen out the product set.

> you have all the work of doing that yourself

There is a difference between unnecessary work and necessary work. When you take in a dependency, you become dependent on it. That is necessary work.

It's great to highlight that dependencies always mean work. There's probably some deeper truth to that, at least in what I do. But that doesn't mean all work is bad. After all, work is what we put in to make things, well, work.

I "maintain" a bunch of fixes (that is, forks) of upstream stuff that I use all around the place. I used to maintain a few packages just for recreation. I have selinux dependencies, ansible playbooks, system accounts, certificates, and a lot of other stuff that I need to maintain in order to make stuff work.

I guess I wanted to say don't be afraid to maintain your dependencies. Sure, it's work, but not unnecessary work.

Reply on news.ycombinator.com