bolha.us is one of the many independent Mastodon servers you can use to participate in the fediverse.
We're a Brazilian IT Community. We love IT/DevOps/Cloud, but we also love to talk about life, the universe, and more. | Nós somos uma comunidade de TI Brasileira, gostamos de Dev/DevOps/Cloud e mais!

Server stats:

251
active users

#supplychain

6 posts6 participants0 posts today

"When Covid hit in 2020, the diversification efforts sped up. The global pandemic — and manufacturing line shutdowns — made it painfully obvious that building everything in one place wasn’t the best idea. Then there was the toll from US inflation, but Apple held firm to its pricing strategy.

The latest tariffs promise to be the biggest test yet — especially because they go beyond China and extend to the very countries Apple has been shifting toward. As I detailed in a story this past week, these production hubs are all getting hit by the new tariffs:

- India, where Apple is increasingly building iPhones and AirPods, will have a 26% tariff.
- Vietnam, where the company now makes some AirPods, iPads, Apple Watches and Macs, will be hit with a 46% levy.
- Malaysia, where Apple is increasingly producing Macs, will have a 24% tariff.
- Thailand, where the company also makes some Macs, will get a 37% levy.
- Ireland, within the European Union, gets a 20% tariff. Apple produces some iMacs there.
- Indonesia, which will soon begin making AirTags and mesh for the AirPods Max headphones, gets a 32% tariff.

The latest tariffs will be 34% for China, bringing its total level to 54%. But the overall picture suggests Apple isn’t going to get as much benefit as hoped from diversifying away from that country. Apple will still be taking a hit on iPhones made in India, AirPods made in Vietnam and Macs made elsewhere in Asia.

There is still a chance that Cook can secure some sort of exemption or that the countries themselves will negotiate better terms. But assuming the levies are fully in place by April 9 as planned, Apple will have a big decision to make: Will it eat the costs of the tariffs, push suppliers to reduce prices, pass on the expense to customers or make further supply chain adjustments? My bet is that Apple will do a combination of all four."

bloomberg.com/news/newsletters

#USA#Trump#Tariffs

Average person will be 40% poorer if world warms by 4C
Experts say previous #economic models underestimated impact of #globalheating – as well as likely ‘cascading #supplychain disruptions’
Australian scientists study suggests average per person #GDP across the globe will be reduced by 16% even if warming is kept to 2C above pre-industrial levels. This is a much greater reduction than previous estimates, which found the reduction would be 1.4%.
theguardian.com/environment/20 #climate #climatechange

The Guardian · Average person will be 40% poorer if world warms by 4C, new research showsBy Graham Readfearn
Replied in thread

So with an #crazyweirdo in command, that talks about new #tariffs on average once per week if not more often, do you want to rely on products from such a country in your #supplychain ?

Want to buy a billion dollar war plane from the #usa when #weirdoinchief might decide next week that your maintenance contract (these go over 30+ years) is suspended because of your countries #diversity policy? Or because it allows "X" in the sex field in the passport? 6/6

In today's Supply Chain News ...

Eleven oooold npm packages were hijacked to steal API keys. Wonder how many of them jise are just sitting on n someone's built pipeline with "latest" as the version parameter?

sonatype.com/blog/multiple-cry

h/t to SonaType for the top notch research.

#supplychain
#npm

www.sonatype.comMultiple crypto packages hijacked, turned into info-stealersMultiple hijacked npm cryptocurrency packages exfiltrate sensitive environment variables via obfuscated scripts and pose risks to open source ecosystems.

Man, npm and supply chain security... seriously a never-ending story. 🙄 Just caught an article about "ethers-provider2" and "ethers-providerz". Get this: these things are actually infecting packages you *already* have installed! 🤯

Speaking as a pentester, let me tell ya: you absolutely *have* to run regular checks. Your `package-lock.json`, `yarn.lock`... check 'em all! Trust me, SCA tools are worth their weight in gold in these situations. And listen up, people, MFA for your npm account? That's not some optional extra, it's a straight-up *MUST*!

I literally just had a client who thought, "Ah, npm's pretty safe, right?". Yeah, famous last words! 🤦‍♂️

So, what're your most insane supply chain attack stories? Lay 'em on me!