Viewing profile — wallrat

There are a few commercial products that allow you to do this also for other ecosystems (e.g. maven, nuget, pypi etc), including ours https://docs.bytesafe.dev/policies/delay-upstr…

There are dependency firewalls that let you enforce this (e.g. https://docs.bytesafe.dev/policies/delay-upstream/ ). Don't know any OSS solutions though.

How does this relate to the OWASP/Ecma Common Lifecycle Enumeration Specification ( https://tc54.org/cle/ )?

Been tracking this project for a while https://github.com/chains-project/ghasum . It creates a verifiable checksum manifest for all actions - still in development but looks very pr…

Very well written (as expected) argument for RSC. It's interesting to see the parallels with Inertia.js. (a bit sad to see all the commenters that clearly haven't read the article …

Still have the Turbo Pascal 1.0 manual on my shelf. It was the first language I picked up after Basic and QuickBasic as a child. Wrote a couple of interesting things a few years la…

Is there any effort to integrate SLSA with PyPI? GitHub recently announced[1] that npm support for SLSA is GA now. [1] https://github.blog/changelog/2023-09-26-npm-provenance-gene.…

> Next step ist to establish good tooling around publishing VEX statements (Vulnerability Exploitability Exchange). That is currently not easy. Agreed. Tooling is needed for creati…

The best kind of "problem" to have. Expect to build features, integrations and other customizations, and factor in the costs. You can do that with a higher "base" price, or include…

DISCLOSURE: I'm working on commercial tooling for this exact problem [1] > 1) What would your expectations be towards a software vendor in terms of what issues to "fix"? I would wa…

Interesting. Do you keep the SBOMs around after the build to track what's running in production?

Are SBOMs a "thing" yet? Is anybody using SBOMs in their day to day workflows? The current tooling for generating them seems to have matured, but tools for storing and managing an …

Interesting. http://simpleredis.com is a similar service, but for Redis instances (for testing, CI etc), including a nice console. Instances terminates after one hour, but you can …

Same here. Last week it was needing Redis slaves to handle 'SLAVEOF NO ONE' from the master without crashing. Needed to tell all read-slaves (hundreds) to stop trying to reconnect …

OP here, not my product, just thought it were interesting, even if hibernation files are an old classic among attack vectors. I do work on something related though, https://scry.co…

Miek Gieben's [1] DNS library [2] is truly excellent. I use it at Port 6379 for an authoritative DNS server, looking up Redis instances [3]. I too have found Go surprisingly produc…

Interesting note, 2 min after submitting to HN, someone seems to have started an DDOS against our API. Working to route around it right now. At first we just thought it was the HN …

Thanks for the feedback! The landing page is definitely MVP, we'll see if we can find a designer to make something more inviting! --andreas

I've spent the last couple of months trying to relieve the pains of running Redis in the cloud. I think we have come up with a rock solid backend which allows for some awesome tool…