2026-06-27 Sat
The instant of installation is madness [1]
- Q: Is there a 2026 install-time tool that tells a non-expert how much supply-chain risk they are adding, without handing them a pile of specialist audit tools?
- This morning I noticed that hacker-news-tui published a Security/Attack/Chain/Supply policy and avoided extra dependencies (cool!). I was looking for Spotify TUI Options it turns out ncspot and spotify-player each bring in more than 500 dependencies throug Rust/crates (ugh!).
- Asked ChatGPT whether there's a CLI that can help do security audits for packages. I was really thinking of something like Snyk, but I didn't say that because I was lazy. It suggested I roll my own AI skill using
cargo audit,cargo deny,cargo geiger,cargo supply-chain,cargo vet, Semgrep, and CodeQL (ugh!)- IT pointed to arXiv/Article/26/02/Auditing Rust Crates Effectively for an idea of how a Cargo Scan tool can narrow down the scope of the source you need to read to validate Rust crates by looking for dangerous effects instead of only checking known vulnerabilities. That's cool, but not helpful.
- So is there no CLI or AI agent skill that analyzes supply chain of a package and helps an end user evaluate the safety of a project?
- It then strongly recommended something called https://agentaudit.dev/ that claims to be a security registry for AI agent packages, MCP servers, and AgentSkills. It has no visible public members, commits are attributed only to
agentaudit-devand Claude, has very few GitHub/Stars, and it's even unclear whether it does anything (https://agentaudit.dev/findings doesn't list anything). (ugh!) - As with many things with AI, this whole thing seems kafka-esque. People are worried about AI deepfakes. I'm more worried about how basically all software now is potentially vulnerable, and there's no easy way to even find out the risk profile of the software you want to use. So, what's to be done? It just seems so crazy that if I ask "testing framework XYZ" I get tons of great results (jest, cyprus, vitest, etc), but if I say "security testing framework XYZ" I get vaporware, roll-your-own, and requests convince your CSO -> CEO -> CFO to get an enterprise subscription for devops to be able to generate SBOMs for auditors.
- I came across Security-Phoenix-demo/security-skills-claude-code which looks a bit more grounded in a dedicated provider: it is tied to Phoenix Security, which at least names people and links to LinkedIn profiles. The look and feel of the website has that real-ish cringe of security-consulting marketing at least. But there are so many products embedded that it's difficult to really see if it's useful; the Phoenix "Platform" consists of Orange, Purple, Blue, and Green products that may or may not have open source equivalents. (ugh!)
[1] This title riffs on Person/Jacques Derrida/Essay/63/Cogito and the History of Madness's quotation of Person/Søren Kierkegaard: "The instant of decision is madness."
Filed
Updated
- acronyms
- IPC
- SMB
- Man in the Middle Attack
- source control management
- AI/Optimization/Policy/Proximal
- Keyshort
- entities
- git-friendly task managers
- not sure how this came up
- BeansTasks
- ff
- beadwork
- journal
- Gard/Diff
- Logseq/Journal/Section/Garddiff
- tuis
- writing
- acronyms