I only skimmed the article, but it was not immediately evident how much blame was to be assigned for flawed thinking like running a Windows monoculture and/or practices based on factors other than security (such as CI/CD). It really reads like a lot of these "supply chain" attacks could be mitigated by already well-known business practices like not relying on a single vendor. For software, multiple builds in multiple heterogeneous environments, including cross-compilation on non-native architectures, would go a long way towards ensuring that there are checks and balances in place to mitigate this sort of threat. 95063281e8f7bad85c6ce72915469c542163406f7b70e8201096ccd0c33593de