Scalably Securing Third-party Dependencies in...
summary
Anthropic builds Dependant, a network gateway that sits between the internet and internal artifact registries and enforces admission control on requested packages and their transitive dependencies. Checks run as policies as Python code with CLI requests, human review for new packages (initially centralized and slow), native pip/npm installs, and inventory/usage metrics. The system adds small friction, creates a cultural shift toward fewer third‑party packages, and moves enforcement to network-level controls to block direct pypi/npm access.
AI-written summary · about
chapters (16)
- 0:00Introduction and setup
- 1:07Speaker introduction and context
- 5:02Supply chain attack overview
- 9:39Why supply chain attacks are effective
- 12:24Introduction to SLSA framework
- 16:21Anthropic’s unique infrastructure needs
- 17:24Limitations of traditional SAS security
- 19:30Introducing Dependant tool
- 21:59Demo of Dependant tool
- 23:01Features and design of Dependant
- 24:48Challenges in rolling out Dependant
- 25:51Future roadmap and Q&A intro
- 26:34Q&A: Shared assurance systems
- 28:00Q&A: Enforcing package controls
- 28:42Q&A: Friction and development pace
- 30:06Closing remarks and acknowledgments
related talks
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
38mDependency Management: The Cause of—and Solution to—All Supply...
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it
31mChoosing Wisely - How to Pick the Right Third Party Packages for your Project
30mDependency management: the cause of—and solution to—all supply chain problems
23mBuilding Secure Package Pipelines
24mManaging Dependencies with Confidence
40mDependency Management: The Cause of—and Solution to—All Supply...