Gergely Orosz on Engineering

Supply chain attacks are becoming more frequent, and far more serious. What are sensible practices to protect against these when using Node or Python packages? I assume pinning versions is the bare minimum; for those with security teams / tools: why else do you do / can you do?

639 likes113 repliesPosted Mar 31, 2026

Remix this post

Your note

Private to you, and used when you remix this post.

Viral score

Based on absolute engagement — the platform doesn’t expose follower counts here, so large accounts score higher.

From likes, comments.

Why it worked

Opens with a short, self-contained line that is easy to take in at a glance.
Follows a clear Hook → Context → Invitation shape, so the reader always knows where they are.
Ends on a question, which is the most reliable way to turn readers into repliers.
The opening line stands alone, so it reads completely before the post is expanded.
Written from experience rather than as advice, which is harder to argue with.
Short enough to read in full without expanding, which removes a step before the point lands.

The mechanics

Hook: Plain observation
Structure: Hook → Context → Invitation
Style: Conversational paragraphs at a steady pace.
Tone: personal, punchy
Written for: Engineers and technical teams

Analysis by ViralLoop — not written by the original author.

Topics

Engineering Materials

Post by Gergely Orosz on X