Viewing profile — lrvick

Thats just all stuff one puts in a containerfile that generates their disk image. We can build any disk image nix can though with different syntax.

https://git.distrust.co/public/airgap/src/branch/main/Contai... That containerfile defines an entire deterministic custom OS image, every package, and every configuration etc. Many…

there are several distros built using stagex to get a disk image like airgapos. Just a containerfile a user writes at the last mile. But when my current "distros" branch lands idea…

Both statements are valid for StageX

You can define an immutable, deterministic, and bootable system image for anything from an enclave to a laptop with just the primitives provided by the OCI Containerfile standard. …

https://stagex.tools

Anyone looking for a full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix, check out https://stagex.tools https://codeberg.org/stage…

Imagine an evil version of this person: https://en.wikipedia.org/wiki/Jo_Zayner

I am finally able to deliver on years of backlog ideas thanks to the GPUs I racked up in my garage. Having a blast. Everyone I know fully dependent on corpotch seems pretty sad tho…

So they will not be accepting most security patches. Fun.

I say this as a fan of a lot of what Framework is doing. Lets not pretend we do not all -know- virtually every SaaS sucks ass at security because it slows down sales. Companies tha…

I would note that we already have groups of hobbyists in the bay area using CRISPr kits to genetically alter frogs, dogs, and in some cases human DNA at home, and even making MNRNA…

I am going to be PRing herdr to stagex as it is my daily driver. This will give it a totally independent release process with multiple parties bootstrapping, reproducing, and signi…

It is not one angry person shutting down the internet or a massive supply chain attack that worries most as a security researcher. I have come to accept such things are way too eas…

While we are building for a dramatically different threat model, we use quite a few of their llvm patches and are very thankful for their work, and alpine making llvm/musl a viable…

We use musl+mimalloc by default for our entire production operating systems: https://stagex.tools

Which is why automated signatures in release pipelines are usually meaningless. Authors must sign their code on their own hardware before it is published so we can tell when the si…

If an author is not willing to do responsible release engineering they should lose their publishing ability and have their project marked as unmaintained. This would force people t…

Refusing security patches and bug fixes because an engineer chose to use an auto-complete engine you do not like is categorically negligent. Might as well mandate everyone use a sp…

Well, they should point users to a project responsible enough to accept huuman reviewed security and bug fixes that happen to have been written by an llm.

I paid $8 for the recently expired email domain of the sole author of NPM package "foreach", so then control to ship any code I wanted to 70k companies was just a support ticket or…

That is because Github is not a thing anymore. We are talking about Microsoft.

It is fascinating how far people will go to do anything else at all other than having authors cryptographically sign their packages like every Linux package manager that matters si…

It really sounds like you should seek out professional help if you have not alread. Everyone deserves to be happy, and in most cases that is possible with the willingness to pursue…

> As much as I try to learn about that AI future I will need to return to, and try to prepare to return to work, there is no returning to who I was Changing the way I have worked f…