Viewing profile — salsakran

Stated differently -- the way OSS software is currently maintained and users are conditioned to behave, there is a capacity problem if the rate of discovery surges too sharply. And…

Yeah ... this gets into the question of what exactly an OSS creator's responsibility is towards users that don't pay them. In theory, nothing. In practice, it's in our long term in…

Thankfully we've historically had a fair amount of attention (and investment in our security) by both customers, our oss users and people our ecosystem. The interesting thing is th…

In theory, the vulnerability was always there, and it's better to find out than not find out. In practice, how much effort it is to find vulnerabilities matters a lot. We're in a t…

I dunno man ... I produced a few things that got a few github stars over the years. At the risk of repeating myself -- this is targeted at other OSS maintainers, not random people …

If you're using unmaintained OSS projects in this day and age, I'm sorry to say you might deserve what happens next.

Perhaps -- but I think for most people, the vast majority of proprietary software they consume is over the network. But yeah, if you're distributing binaries publicly, then you're …

With all respect to the Anthropic folks, that's just marketing. (If they're reading this: let us into the program so I can be proven wrong here.) I'm sure what they have is awesome…

That line was aimed at other OSS maintainers. These alerts are absolutely not being shared publicly before we have a fix for them.

Side conversation -- This is all stuff we're seeing in white/grey hat land. What's going on in blackhat land?

That was true last year -- things changes. Ignore (admittedly low-effort LLM generated) reports at your own peril.

I'm not sure that the benefit of many eyes helps here. So much of this bulk scanning is low-effort, and if you're a smart person developing closed source software you get the benef…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | All Roles We’re hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy …

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your compa…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the Engineering team (and in m…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the Engineering team (and in m…

Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the team. Metabase is open sou…