So github response to the recent TeamPCP hacks is good. I wonder if threat actors will be moving to compromise OCI images instead, as the mutability of tags in Docker presents a similar vulnerability as the mutable tags in git releases do

So like what are the best atproto / atmosphere apps? I'm aware of tangled, but that's about it

After configuring my @tangled.org knot, I've gotten kind of obsessed with the idea of self-hosting the entirety of my dev workflow. Next I'll be self-hosting a image registry I reckon, just for the hell of it. Imagine being free of the big-tech hegemonies in your hobbyprojects!

For open source projects, discord is great for quick chats and community building, but i don't think it's good as a hub for community info. in particular, the lack of discoverability is a problem imo. I can't stumble over a discord chat that happened last year, like i can with a gh issue

@tangled.org hey, the self-hosted knots section for ssh config seems to be down. I figured out my issue after a morning of trying random things. Kinda frustrating that I have to use my DID in the remote setup, as I never remember it. Can I set up an alias from audunmo.dev -> did on my knot?

Is Github Actions down again?

Mark Zuckerberg opens Emacs and writes some PHP -> the fates of Venezuela, and potentially Greenland, are uncertain. That's the butterfly effect for you

As much as I love the spirit and idea of DependencyTrack, I really dislike the implementation. The app is heavy on resource consumption, the API is clunky to use, and lack of token auth for automation feels ironic for a security focused project

I opened X to look at Elon Musk tweet. Do I hate myself? Why did I do that to myself?

What is h a p p e n i n g over at cloudflare. Down, again???

Damn, ECMAScript-like syntax and compiles to bash? Folks, I think I'm in love amber-lang.com

I'm thinking of forming dependency track. I think its promise could be delivered in a much simpler app. First thing is to combine the frontend and API to a single container. Second order of business would be to introduce OIDC based token auth for m2m

Manifesto:

Within sometime in the next five years, there will be a story of someone using an LLM like a GPS to navigate, and it will be hilarious

I have no earthly idea why the world landed on using SPDX over CycloneDX as its default. And I'm so sad about it

Today, Go's 1.25.1-bookworm image suddenly changed hash

The fact that tags are immutable on docker hub by default blows my mind.

At what point do we just classify the entirety of npm as a vulnerability, and just be done with it? Js needs a better standard library, and packages that can't randomly RCE your build pipeline if they feel like it

If you sell products that purport to shift left, but don't support IaC or other code-based config, the product is not doing that. UIs and click-ops invite reactive, right-end operations, and it's often a sign of other legacy thinking / approaches in your tools

Pushing ads on a service, then making a subscription to not have ads, is not a feature. It's not a product. And if it's the best you can think of, your company produces nothing

Linkedins algorithm for what to create notifications for needs to be studied. I don't think I've seen an algo less able to find relevant information

Bad features cause security risks, like bad road layouts lead to accidents. Case in point, github notifications. Filtering out the noise is so hard that I find drawn to separate apps to handle them. I don't because of the risk, but the avalanche ushers me in their direction

A long time ago, I saw a thing about programmers on dating apps who make themselves out to be much more important than they are. "Calm down, Brad. You're making computers go beep boop correctly" is still one of my favorite take down of anyone online

I thought to myself "the clock is just Thursday". In other words, my friend's 5 day bachelor party is going well

Note to anyone creating a scripting or rule or whatever language. Do not design your language so that comparison happens with =. Always assign with = and compare with ==. Otherwise all code produced in your language will be bad. And if = does both, you do not deserve good things in your life

It is 2025. Stop sending "hi" on slack. Just say the thing you want or need right away

I think "don't meet your heros" also applies to looking at your heros Twitter account

If it computes, someone has already installed doom on one

Contender for best feeling ever 🧹🧹🧹

Does anyone know how renovate or dependabot handles a git release tag being moved to a new commit for github actions when you've pinned your workflow to commits? Do they create new update PRs to reflect the new commit? Or do they stay on the existing pinned commit?

The compromise of GitHub Action tj-actions/changed-files has impacted only a small percentage of the 23,000 projects using it, with it estimated that only 218 repositories exposed secrets due to the supply chain attack.

🧵Ref tj-actions attack. I wonder, would it be possible to retrofit a lockfile system on top of github actions?

Is there any way to generate an SBOM that describes github actions and their transitive dependencies? Ref tj-actions. I feel like this should be a thing

The cookie banners on websites should be re-implemented as native buttons in the UI of my browser, with the option of auto-rejecting all non-essential cookies forever. There shouldn't be a million different modals with different language and layout

I'm not in the java ecosystem. Has the {x}4j branding suffered at all? Because whenever I hear, for example neo4j, I immediately think of log4j and log4shell

If you're trying to pitch to devs, drop the fucking buzzwords. At the very least know what the words actually mean. I see so many people who are new to the field who slap so much bullshit lingo onto their HN/Reddit post, and it just all falls apart under a tiny bit of scrutiny. All credibility gone

Is it just me or does Lindsey Graham look drunk?

Writing a terraform provider is a purely spite-fueled exercise. You're just sitting there cursing at some half-baked API for a product your company is paying a bajillion for, stunned that they didn't ship basic IaC. In totally unrelated news, my favorite slack emoji is :no-google:

This plays in my head the moment I search up Bluesky on my phone youtu.be/aQUlA8Hcv4s?...

Also, does anyone have any experience with running ClusterFuzz? How much is the overhead to run it, and how much does the compute cost?

I wonder.. Could one easily take something like github.com/getkin/kin-o... and use it as a base to fuzz Go APIs with go's built-in fuzzer? 🤔

I've become so annoyed at vendors for not shipping IaC that I've just begun learning to write tf providers myself. Like they almost always ship and API to manage resources, but just forget to make it useful

Proposing an extended SemVer - 🗿 Epoch Semantic Versioning to communicate better about versions. Thinking of adopting this to all my projects, and finally eliminating my lousy habit of forever zero-major practice 😜 What do you think? 👀 antfu.me/posts/epoch-...

Is my system borked, or is docker hub down? Getting only 500s

Possibly hot take: the standard lib and tooling for Go is the reason to use it, way more so than the concurrency primitives

Don’t submit low effort automated bug reports for nothing and then do this

I'm unsure if I'm now old enough to be the target for 2000s nostalgia bait, or if the things I liked as a teen are now getting retro cool. In either case, I'm happy about the return of nu metal 🤘 open.spotify.com/track/2PcaKo...

Dear bug bounty hunters. I know you mean well. But please, make sure you actually demonstrate impact of a vuln. I'm so exhausted by all these emails of absolute nothing-burgers

I'm considering building a project that tries to have go as its only dependency. Gonna go absolutely bonkers with build tags and `go generate`. This might be stupid, but it might also be brilliant. But probably stupid

Do you think the reason why ChatGPT so often produces lists as responses is because it was trained on BuzzFeed style listicles?