Supply Chain Threats in Software Industry Caused by Geo Political Influences and Business Model Changes
Creators: name: Chew, Kean Ho
Publisher: name: Zenodo
Year: 2022
Subjects: software industry
supply chain threats
geo political influences
business model changes

description: Developing software since year 2005 was as easy and seamless as using a free pricing version control service provider such as but not limited to Bitbucket, GitHub, and GitLab. These service providers serve the global market easily by facilitating all-in-one facilities from development to product distribution of both source codes and compiled software archives. In fact, new generation software supply chain tools like Homebrew, Go Module, Ruby Bundle, and etc. are almost entirely developed surrounding these service providers, making software distributions seamlessly easy. However, such conveniences had made the global software supply chain (also known as "dependencies" or "dependencies of dependencies") overly centralized to a country or a single origin source where it can be weaponized by the politicians or the business owners themselves. This makes any software developers residing outside of the service provider’s country of origin or deeply locked into the vendor's services completely vulnerable and are forcefully to comply with laws and political norms they are not residing in and originated from. This is especially true for those who are from a country unfavorable to those country of origin. This paper specifically addresses such supply chain vulnerability in software industry from both residences and non-residences of the service provider's country of origin and the consequences of such vulnerability when overlooked. The paper also explores current known methods to mitigate such vulnerability that is compatible for both types of developers.
description: {"references": ["ATLASSIAN; 2022; \"Bitbucket \u2013 Plans and Pricing\"; Bitbucket; Atlassian via atlassian.com; accessed on July 9, 2022; available at: https://www.atlassian.com/software/bitbucket/pric ing", "GITHUB; 2022; \"GitHub Pricing \u2013 Choose the Plan That's Right for You\"; GitHub Inc. via github.com; accessed on July 9, 2022; available at: https://github.com/pricing", "GITLAB; 2022; \"GitLab Pricing \u2013 Get the One DevOps Platform\"; GitLab B.V. via about.gitlab.com; accessed on July 9, 2022; available at: https://about.gitlab.com/pricing/", "HOMEBREW; n.d.; \"Homebrew Documentation \u2013 Taps (Third-Party Repositories)\"; Homebrew via brew.sh; accessed on July 9, 2022; available at: https://docs.brew.sh/Taps", "GOOGLE; n.d.; \"Go Modules References\"; Go via go.dev; accessed on July 9, 2022; available at: https://go.dev/ref/mod", "RYAN BIGG; n.d.; \"Bundler Docs \u2013 How to Create Ruby Gem with Bundler\"; Bundler via Bundler.io; accessed on July 9, 2022; available at: https://bundler.io/v2.3/guides/creating_gem.html", "RITA LIAO, MANISH SINGH; 2019; \"GitHub confirms it has blocked developers in Iran, Syria and Crimea\"; Yahoo via techcrunch.com; accessed on July 9, 2022; available at: https://techcrunch.com/2019/07/29/github-bansanctioned-countries/", "NATHANIEL MOTT; 2019; \"GitHub Blocks Iran, Syria and Crimea-Based Users (Update)\"; News; Future US, Inc. via tomshardware.com; accessed on July 9, 2022; available at: https://www.tomshardware.com/news/githubreportedly-blocks-users-crimea-iran,40035.html", "NATHANIEL MOTT; 2022; \"GitHub Reportedly Suspends Accounts Related to Sanctioned Russian Orgs\"; News; Ziff Davis. Pcmag Digital Group via pcmag.com; accessed on July 9, 2022; available at: https://www.pcmag.com/news/github-reportedlysuspends-accounts-related-to-sanctioned-russianorgs", "GITHUB STAFF; 2022; \"Reply to Cut Russia from GitHub due to Massive Invasion of Ukraine\"; Community &gt; Discussions; Github Community; GitHub Inc. via github.com; accessed on July 9, 2022; available at: https://github.com/github-community/community/di scussions/12042?sort=top", "G\u00d6RAN MARBY; 2022; \"Formal Reply from Marby to Fedorov\"; ICANN via icann.org; accessed on July 9, 2022; available at: https://www.icann.org/en/system/files/corresponden ce/marby-to-fedorov-02mar22-en.pdf", "HANS PETTER HOLEN; 2022; \"RIPE NCC Response to Request from Ukrainian Government\"; Publications &gt; News &gt; Announcements; RIPE Network Coordination Centre; accessed on July 9, 2022; available at: https://www.ripe.net/publications/news/announcem ents/ripe-ncc-response-to-request-from-ukrainiangovernment", "MATTHEW PRINCE; 2022; \"Steps We've Taken Around Cloudflare's Services in Ukraine, Belarus, and Russia\"; Cloudflare Blog; Cloudflare Inc. via The Cloudflare Blog; accessed on July 9, 2022; available at: https://blog.cloudflare.com/steps-taken-aroundcloudflares-services-in-ukraine-belarus-and-russia/", "STEVEN MILLWARD; 2013; \"Social Coding Site GitHub Unblocked and Accessible Again in China\"; News; Tech in Asia via techinasia.com; accessed on July 9, 2022; available at: https://www.techinasia.com/github-china-unblockedaccessible-again", "RITA LIAO; 2020; \"China is Building a GitHub Alternative Called Gitee\"; News; Yahoo via techcrunch.com; accessed on July 9, 2022; available at: https://techcrunch.com/2020/08/21/china-isbuilding-its-github-alternative-gitee/", "SID SIJBRANDIJ; 2021; \"GitLab is moving to a threetier product subscription model\"; Blog; GitLab via about.gitlab.com; accessed on July 9, 2022; available at: https://about.gitlab.com/blog/2021/01/26/newgitlab-product-subscription-model/", "SID SIJBRANDIJ; 2022; \"Upcoming changes to User Limits on Free Tier of GitLab SaaS\"; Blog; GitLab via about.gitlab.com; accessed on July 9, 2022; available at: https://about.gitlab.com/blog/2022/03/24/efficient -free-tier/", "JUNE RHODES; 2022; \"GitLab introduces user limits for Free users on SasS\"; Forum; GitLab via forum.gitlab.com; accessed on July 9, 2022; available at: https://forum.gitlab.com/t/gitlabintroduces-user-limits-for-free-users-on-saas/ 64288/43", "P.J. REED; 2022; \"GitLab introduces user limits for Free users on SasS\"; Forum; GitLab via forum.gitlab.com; accessed on July 9, 2022; available at: https://forum.gitlab.com/t/gitlabintroduces-user-limits-for-free-users-on-saas/ 64288/21", "CBS; 2020; \"Trump Speculates About Injecting Disinfectants to Treat COVID-19\"; News; CBS via CBS News; accessed on July 9, 2022; available at: https://www.cbsnews.com/news/coronavirustrump-injecting-disinfectant-covid-19/", "DARTUNORRO CLARK; 2020; \"Trump Suggests 'Injection' of Disinfectant to Beat Coronavirus and 'Clean' the Lungs\"; Politics &gt; Donald Trump; accessed on July 9, 2022; available at: https://www.nbcnews.com/politics/donald-trump/t rump-suggests-injection-disinfectant-beatcoronavirus-clean-lungs-n1191216", "AGENCIES/IK; 2021; \"Tajuddin terminated as Prasarana chairman 'with immediate effect' after KL LRT crash, says MOF\"; Asia; Channel News Asia; accessed on July 9, 2022; available at: https://www.channelnewsasia.com/asia/tajuddinklcc-train-crash-lrt-prasarana-chairmanterminated-1407666", "NEW STRAITS TIMES; 2021; \"4PAM: Tajuddin's manner at press conference 'rude and disgusting'\"; News &gt; Nation; New Straits Times Press (M) Bhd. part of Media Prima Group; accessed on July 9, 2022; available at: https://www.nst.com.my/news/nation/2021/05/6932 30/4pam-tajuddins-manner-press-conference-rudeand-disgusting", "DAN DEMICHELE; 2021; \"Changes to LastPass Free\"; Blog &gt; Product Updates; LogMeIn, Inc.; accessed on July 9 2022; available at: https://blog.lastpass.com/2021/02/changes-tolastpass-free/", "YAP WAN XIANG; 2021; \"Dr M Says Chinese Using Chopsticks To Eat Is A Reason Why There's No Malaysian Identity\"; Malaysia News; Rev Media Group, a part of Media Prima Group via SAYS; accessed on July 9, 2022; available at: https://says.com/my/news/dr-m-says-chinese-usingchopsticks-to-eat-a-reason-why-it-s-hard-to-form-am-sian-identity", "ADELINE LEONG; 2022; \"Selangor Sultan Says PAS Chief's Statement Regarding Bon Odori After Royal Audience Inaccurate\"; News; 3rd Wave Media Sdn. Bhd. via The Rakyat Post; accessed on July 9, 2022; available at: https://www.therakyatpost.com/news/2022/06/17/se langor-sultan-says-pas-chiefs-statement-regardingbon-odori-after-royal-audience-inaccurate/", "DR MISHAL REJA; 2021; \"Trump's 'Chinese Virus' tweet helped lead to rise in racist anti-Asian Twitter content: Study\"; Health; ABC News Internet Ventures; accessed on July 9, 2022; available at: https://abcnews.go.com/Health/trumps-chinesevirus-tweet-helped-lead-rise-racist/story? id=76530148", "ANDREW OSBORN, POLINA NIKOLSKAYA, DAVID LJUNGGREN, OLZHAS AUYEZOV; MARIA TSVETKOVA, GLEB STOLYAROV; 2022; \"Russia's Putin authorises 'special military operation' against Ukraine\"; World &gt; Europe; Reuters; accessed on July 9, 2022; available at: https://www.reuters.com/world/europe/russiasputin-authorises-military-operations-donbassdomestic-media-2022-02-24/", "LASTPASS; 2022; \"Plan &amp; Pricing \u2013 Choose a Plan that Works For You\"; LastPass US L.P; accessed on July 9, 2022; available at: https://www.lastpass.com/pricing", "BITWARDEN; 2022; \"Bitwarden Pricing \u2013 Choose the Plan That Fits Your Needs\"; Bitwarden Inc; accessed on July 9, 2022; available at: https://bitwarden.com/pricing/", "MARAK; 2021; \"Monetizing Open-source is problematic\"; Blog; Marak.com via web.archive.org; accessed on July 9, 2022; available at: https://web.archive.org/web/20211030075524/htt ps://marak.com/blog/2021-04-25-monetizingopen-source-is-problematic", "WINDCAPE; 2022; \"Marak, creator of faker.js who recently deleted the project due to lack of funding and abuse of open source projects/developers pushed some strange Anti American update which has an infinite loop\"; Programming; Reddit Inc via reddit.com; accessed on July 9, 2022; available at: https://www.reddit.com/r/programming/comment s/rz5rul/comment/hs3e29i/? utm_source=share&amp;utm_medium=web2x&amp;context =3", "LIZ GOFF; 2020; \"More Charges Possible For Astoria Bomb Suspect\"; The Service Advertising Group, Inc. via Queen Gazette; accessed on July 9, 2022; available at: https://www.qgazette.com/articles/more-chargespossible-for-astoria-bomb-suspect/", "CHRIS WILLIAMS; 2016; \"How one developer just broke Node, Babel and thousands of projects in 11 lines of JavaScript\"; Software; The Register a part of Situation Publishing; accessed on July 9, 2022; available at: https://www.theregister.com/2016/03/23/npm_left _pad_chaos/", "DEBIAN; 2022; \"Securing Debian Manual \u2013 5.2. Securing Squid\"; Public Interest Inc. via Debian Organization; accessed on July 10, 2022; available at: https://www.debian.org/doc/manuals/securingdebian-manual/ch05s02.en.html", "GOMODS; 2022; \"Athens \u2013 Welcome to Athens, Gophers!\"; gomods; GoMods via Github. Inc; accessed on July 10, 2022; available at: https://github.com/gomods/athens", "CHEW KEAN HO; 2022; \"Holloway's GoWASM Experiments\"; Personal Repo; HollowayKeanHo via GitHub Inc.; accessed on July 10, 2022; available at: https://github.com/hollowaykeanho/Experimentin gGoWASM", "GITEA; 2022; \"Gitea \u2013 Git with a Cup of Tea\"; Gitea Communities; accessed on July 10, 2022; available at: https://gitea.io/en-us/", "ZORALAB; 2022; \"ZORALab's Montuer\"; Monteur Team via ZORALab Enterprise; accessed on July 10, 2022; available at: https://monteur.zoralab.com/en/", "TIM ANDERSON; 2020; \"Travis CI complains of 'significant abuse' of its free deal, creates new pricing that has developers riled\"; DevOps; Situation Publishing via The Register; accessed on July 10, 2022; available at: https://www.theregister.com/2020/11/02/travis_ci_pri cng/", "JAANA DOGAN, NICK GOEDE; 2019; \"Personal Tweet \u2013 Regardless of outcome, I'm going to stop using @travisci\"; Twitter Inc.; accessed on July 10, 2022; available at: https://twitter.com/rakyll/status/10986750474163118 08", "ZORALab; 2022; \"Monteur | Getting Started with GitLab CI\"; Monteur Team via ZORALab Enterprise; accessed on July 10, 2022; available at: https://monteur.zoralab.com/en/getting-started/gitla b/", "SOFTWARE FREEDOM CONSERVANCY; n.d.; \"gitrequest-pull \u2013 Generate a Summary of Pending Changes\"; Software Freedom Conservancy via gitscm.com; accessed on July 10, 2022; available at: https://www.git-scm.com/docs/git-request-pull", "SOFTWARE FREEDOM CONSERVANCY; n.d.; \"gitformat-patch \u2013 Prepare patches for E-Mail Submission\"; Software Freedom Conservancy via gitscm.com; accessed on July 10, 2022; available at: https://git-scm.com/docs/git-format-patch", "SOFTWARE FREEDOM CONSERVANCY; n.d.; \"git-am \u2013 Applies a Series of Patches from a Mailbox\"; Software Freedom Conservancy via git-scm.com; accessed on July 10, 2022; available at: https://git-scm.com/docs/git-format-patch"]}