Viewing profile — ievans

Last year I thought that AI-generated code would be scanned the same way as human-generated code. What I realized from working on Guardian was that being in the agent loop is an un…

Top comment has a great explicit refutation: > This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automat…

Not super surprising that Anthropic is shipping a vulnerability detection feature -- OpenAI announced Aardvark back in October ( https://openai.com/index/introducing-aardvark/ ) an…

"Staged publishing: A new publication model that gives maintainers a review period before packages go live, with MFA-verified approval from package owners. This empowers teams to c…

This is explicitly not the conclusion Pascal drew with the wager, as described in the next section of the Wikipedia article: "Pascal's intent was not to provide an argument to conv…

Do you store your SSDs powered? They can lose information if they're not semi-frequently powered on.

For C, you might be interested in https://github.com/weggli-rs/weggli or https://github.com/semgrep/semgrep (I work on the latter). Both are also tree-sitter based.

Looks like the `ets` readme has a direct comparison: > The purpose of ets is similar to that of moreutils ts(1), but ets differentiates itself from similar offerings by running com…

I wrote up a Semgrep rule as a comparison to add! (also tree-sitter based, `pip install Semgrep`, https://github.com/semgrep/semgrep , or play with live editor link: https://semgre…

So the argument is because the vulnerability lifetime is exponentially distributed, focusing on secure defaults like memory safety in new code is disproportionately valuable, both …

Absolutely agreed, and copying from a comment I wrote last year: I think the fact that tree-sitter is dependency-free is worth highlighting. For context, some of my teammates maint…

I'm surprised there are so many negative comments on this release, which I suppose is timed for discussion at Blackhat/Defcon. The report's identifies its audience as four groups o…