LLMs, Supply Chain Attacks & The Trust Layer

Help Security
1

Warning: This is a topic that relates to LLMs and what they do / do not enable, but that’s not the main story here.

I have found that LLMs to some extent are able to materially unblock certain initiatives. I believe it is much easier to publish plugin layers (even if maintaining them may require an ongoing dependence on models) that before required some combination of specialist knowledge and extreme patience. I’m not necessarily saying it’s one-click to take native libraries and pul them in, but I think it’s safe to say that if you’re a capable systems engineer and you have access to a strong model, the bar has materially lowered by some variable amount to publish something.

I raise this today because I am starting to see the emergence of some packages that seem too good to be true, bundling a wide variety of native packages that have not previously been easily accessible to Flutter developers through one easy API. Some of these publishers happen to be very new. While it’s possible that we’re in a golden age of abundance, I am personally not yet inclined to believe that, and I think it’s a reasonably agreeable point that there is some risk to digital supply chains in the years ahead.

All of that being said, I’m interested in what other people are thinking about this. It seems to me we could try to audit the monolithic aggregating packages ourselves, we could use LLMs to do so, or we could choose not to trust altogether.

2

I was thinking about something similar, for example I have found this recently https://github.com/rudra-sah00/ssh-client

but barely any users https://tooomm.github.io/github-release-stats/?username=rudra-sah00&repository=ssh-client

Surprisingly there aren’t many open source ssh flutter clients. Luckily I didn’t introduce any credentials, just installed it on my phone and looked at the menus.

I couldn’t find any free LLM that could reliably help with code review, without doing a bunch of setup. Right now I don’t really have energy to look through the code myself.

3

There was an interesting talk at this year’s I/O that had the same direction. It was systems thinking applied to the world of LLMs, basically, and part of it went something like: “hope you’re ready for 10-100x more code”. It’s not just code reviews — at that scale, even things like CI/CD pipelines and git starts to be too slow (at least at Google monorepo scale).

In some way, we’ll all need to find the right balance. We can’t all start porting everything to Dart via AI and expect things not to break. We also can trust 3rd party libraries even less than before.