A Microsoft engineer noticed something was off on a piece of software he worked on. He soon discovered someone was probably trying to gain access to computers all over the world.
Right now the greatest level of supply chain secuirty that I know of is formal verification, source reproducible builds, and full source bootstrapping build systems. There was a neat FPGA bootstrapping proj3ct (the whole toolchain to program the fpga could be built on the FPGA) at last years FOSDEMs conference, and I have to admit the idea of a physically verifiable root of trust is super exciting to me, but also out of reach for 98% of projects (though more possible by the day).
Right now the greatest level of supply chain secuirty that I know of is formal verification, source reproducible builds, and full source bootstrapping build systems. There was a neat FPGA bootstrapping proj3ct (the whole toolchain to program the fpga could be built on the FPGA) at last years FOSDEMs conference, and I have to admit the idea of a physically verifiable root of trust is super exciting to me, but also out of reach for 98% of projects (though more possible by the day).