21–30 of 80 posts
Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…
Off topic: took a look at the domain, had a foreboding on the innuendo, found mostly what I expected on put.as …
Off topic: took a look at the domain, had a foreboding on the innuendo, found mostly what I expected on put.as …
CUE's module system is finally rolling out, MVS likes Go's, but built on OCI infra. If you are interested in dependency management systems, here are some links - proposal: https://github.com/cue-lang/proposal/tree/main/designs/modul... - custom registry: https://cuelang.org/docs/tutorial/working-with-a-custom-modu... - road map: https://github.com/orgs/cue-lang/projects/10/views/8 - in 0.9.0-alpha-5, modules become e…
Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…
(I am a former Google SAD-SRE [Spam, Abuse, Delivery])
CUE's module system is finally rolling out, MVS likes Go's, but built on OCI infra. If you are interested in dependency management systems, here are some links - proposal: https://github.com/cue-lang/proposal/tree/main/designs/modul... - custom registry: https://cuelang.org/docs/tutorial/working-with-a-custom-modu... - road map: https://github.com/orgs/cue-lang/projects/10/views/8 - in 0.9.0-alpha-5, modules become e…
What does that have to do with the linked article?
So CUE's module design can be seen as an evolution on Go's, building on the good parts while addressing some of the shortcomings.
Fun fact, CUE started as a fork of Go, mainly for the internal compiler tooling and packages
I toyed with the idea of piggybacking on (i.e. abusing) the golang proxy and sumdb to have a free transparent log of checksums of arbitrary URLs https://getsum.pub/
sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that. https://www.sigstore.dev/ https://docs.sigstore.dev/logging/overview/
As a user, the npm usage doesn't seem very prominent. On an npm's web page, there's a checkmark next to the version number on the right side that I hadn't paid any attention to before, with more information at the very bottom of the page. Here's an example. [3]
[1] https://blog.sigstore.dev/npm-provenance-ga/ [2] https://blog.sigstore.dev/homebrew-build-provenance/ [3] https://www.npmjs.com/package/fast-check
Maybe I'm being stupid but what exactly is the issue here? It's probably a bit wasteful of the proxy to cache non-Go repos, but even if it didn't you could make it store arbitrary data just by having it cache a Go repo surely? Sounds like a complete non-issue unless I've missed something.
Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…
And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])
Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…
And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])