Viewing profile — wereHamster

Some reasons why an org might want to become their own CNA: https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/

> Add a mechanism to donate tokens Or donate money. Crazy idea, eh?

I was just looking into microvm (via microvm.nix) to isolate coding agents. While the machine starts quickly, as in the article, the userspace (nixos) takes much longer. I'd probab…

After I upgraded pnpm to v11, I set all allowBuilds to false and have not observed any failures. Made me wonder why the packages even need build scripts. My guess is for obscure or…

I'm looking forward to the analysis how the attacker managed to compromise CI. I was reading through the workflow and what immediately jumped out was a cache poisoning attack. Seem…

CDN wouldn't help much. These days browsers partition caches by origin, so if two different tools (running on different domains) fetch the same model from the CDN, the browser woul…

I bought a light HF acid (rust remover) so I can properly clean titanium parts before anodizing. Worked like a charm...

business.apple.com doesn't work in Firefox, it redirects you to https://business.apple.com/abm_unsupported_browser?reason=Br... Fuck you Apple.

China is already slowing down the addition new fossil fuel power plants. Yes, they still build new ones, yes they generate a lot of emissions. But they are also adding more than th…

A loooong time age (OpenSolaris days) I had a system that had corrupted its zfs. No fsck was available because the developers claimed (maybe still do) that it's unnecessary. I had …

Ok. So to answer the question whether the code for v1.0.0 that I downloaded today is the same as I downloaded yesterday (or whether the code that I get is the same as the one my co…

Let's assume I publish a github repo with some go code, and tag a particular commit with tag v1.0.0. People start using it and put v1.0.0 into their go.mod file. They use the golan…

Now I understand :) thanks for clarifying

A lock file, in my world, contains a cryptographic hash of dependencies. go.mod does not, it only lists tags, which are (in git) movable references. If go.sum has "no observable ef…

I just recently learned of Meshtastic ( https://en.wikipedia.org/wiki/Meshtastic ) and MeshCore ( https://meshcore.nz/ ), which provide a platform for private and group messaging o…

I repurposed old M1/M4 Mac Mini's at my workplace into GitHub action runners. Works like a charm, and made our workflows simpler and faster. Persisting the working directory betwee…

I just ordered the BD790i X3D mainboard. A while ago Minisforum has been known for their slow BIOS updates, but hope that they have improved their processes since. I'll see…

We got rid of all Rails apps (that needed a backend). We've moved our Postgres databases to Neon, and run our docker containers on Google Cloud Run (these are containers that don't…

We just managed to shut down our last Heroku service a week ago. Good riddance.

AGPL is a no-go for many companies (even when it's just a tool that touches your code and not a dependency you link to).

Could it be that they removed /all/ comments from the codebase when they made it public, to not release some sensitive information that was in them?

A year ago I was traveling through Uzbekistan while also partly working remotely. IKEv2 VPN was blocked but thankfully I was able to switch to SSL VPN which worked fine. I didn't e…

> Either way, scanning that space is probably a waste of bandwidth That's what the DoD wants you to think ;)

securityscorecard is easy to integrate (it's a cli tool or you run it as a github action), one of the checks it performs is "Pinned-Dependencies": https://github.com/ossf/scorecard…