Developer workstations are now supply chain nodes

The article hits on something I've been feeling for months: our local dev environments are the new attack surface no one wants to talk about. I've been running a personal experiment with Nix flake to pin every toolchain dependency, and it's terrifying how many packages I install via curl | sh without thinking. My dotfiles repo is basically a supply-chain manifest now. The real shift for me was realizing that my homebrew tap is just as critical as my production Dockerfile. When I clone a repo and npm install pulls 800 packages, I'm trusting that my local machine's cache isn't poisoned. I started using oras to verify container signatures locally, but I still blindly trust VS Code extensions that can read my entire filesystem. What keeps me up is the asymmetric nature of this: a compromised workstation can pivot into production faster than any CI pipeline vulnerability. I'm now treating my laptop like a prod node, with hardware-backed keys and audit logging for every build command. It feels paranoid until you realize the average developer has more direct access than the entire ops team combined.