Post details
Content warning: dhh and transphobia
Content warning: dhh and transphobia
Dan Lorenc, co-founder and CEO of Chainguard, joins Dennis Fisher to dig into the recent XZ Utils backdoor incident, the implications for the open source ecosystem, and what can be done to avoid similar incidents in the future. Then they discuss the problems facing NIST’s National Vulnerability Database and the CVE ecosystem.
“trans people don't want equality, they want special treatmen-” Special treatment would be if LGBTQ+ people didn't have to pay taxes. You know, like churches. :trantifa:
How about a Hey Friends! T-shirt!? ALL proceeds go to charity https://www.bonfire.com/hey-friends/
I have a lot more to say, but I'll hold it for now and simply wonder aloud... Which BigTech clouds are the "Lavender" & "Where's Daddy?" AI systems running on? What APIs are they using? Which libraries are they calling? What work did my former colleagues, did I, did *you* contribute to that may now be enabling this automated slaughter? (Also, content warning. This is some of the sickest shit I've ever read.) https://www.972mag.com/lavender-ai-israeli-army-gaza/
Between and I took 2837 steps.
Attached: 1 image #rustlang #xz #supplychain
get into computers, they told me when i was a kid, you'll have fun and possibly a rewarding career! reality: my computers have been interdicted by intelligence agencies to install god knows what on them before i receive them, presumably in the hope of extricating my signing keys, i have to deal with something called "docker", and another thing called "kubernetes", there is a whole profession called DevOops and i have to deal with entitled pricks who say my projects are "dead" because i did not review their error-ridden patches fast enough for their liking
I love people who say “what is missing from society is support for opposing and dissenting points of view.” I then ask them, “did you schedule your pro-cancer rally this year?” Yeah! Go cancer! Those cells have every right to be unique and different and thrive! 🎉
Your belated reminder, in the aftermath of the xz backdoor, that open source maintainers still owe you nothing: https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/ Not only do they owe you nothing but: if they are running a large open source project at scale and have been doing so for a while: in almost every case they know vastly more about doing so than almost anyone else in the world does. Open source users and contributors: show some more gratitude and, frankly, deference to the maintainers who keep OSS alive.
accidentally wrote "saad" instead of "saas" in a text to my partner; they immediately coined "Software as a Disappointment" and honestly, where is the lie
@shanselman I think my biggest concern now is 'code review now comes with a rousing game of Among Us', but I'm still weighing that concern in a larger context.
Ten years ago today, a new app arrived to strip the "media" out of social media, reducing messaging to two little letters. It burned bright, but not for long.
... next month... Me: "Dear maintainer, can you please bump package XY?" Maintainer: ...furiously starts looking into the git diff looking for a backdoor.
Hmm, will have a think about it - this may come down to a bit of verbosity and explicit checking in Go. I think I'd prefer to see it be more explicit when constructing the entity in terms of what happens when it's set, but I get your point
There's .Get
or .MustGet
(not ideal outside of tests or CLIs) that you can use to work out whether the value is there, but given you may want to check IsSpecified
and IsNull
, that's why there's no way to get it back as a pointer
That library doesn't handle "field not set" vs "field explicitly set to null" - https://github.com/guregu/null/issues/39#issuecomment-1895386392
You may want to give https://github.com/oapi-codegen/nullable a go for this instead - we wrote it because /none/ of the options out there worked for all the cases you need to handle - more info at https://www.jvt.me/posts/2024/01/09/go-json-nullable/
Q1 2024 is officially behind us. So we figured that it was a great time for a bit of reflection on the exciting start to the year. In this episode, we sit down with our founders, Stephen, Chris, and Pete, to get a bit of perspective on how the last three months played out. We chat about On-call, our AI launch, and the hundreds of other features, bug fixes, and bits of polish and delight that we've shipped over the last 12 weeks. We also chat about the state of the company as a whole, our growth, and ultimately what's on the horizon.
I recently went through a job search, and I thought it would be good to do a mini retrospective on the whole experience. Overall, it was a better candidate experience than the last time I interviewed so I want to believe that the industry is making progress.
I may be attending
.Robin Guldener from Nango talks to Mike about building an open, unified API, the value of building on top of Open Source products, and building a growing product team on this episode of the podcast.
Josh and Kurt talk about the recent events around XZ. It’s only been a few days, and it’s amazing what we already know. We explain a lot of the basics we currently know with the attitude much of these …
Between and I took 3457 steps.
Enhance and enrich your OpenAPI descriptions without creating conflicts in the source code using filters and overlays.
Between and I took 6942 steps.
Which is smarter: specializing in a particular tech or becoming more of a generalist? It depends! Which is why Jerod invited “undercover generalist” Adolfo Ochagavía on our “It Depends” series to weigh the pros & cons of each path.
Just did a task that was open since Feb. 20th that will unblock six teammates doing full-time work starting this week. It took 5 minutes 35 seconds to finish. I will, again, learn nothing from this.
Attached: 1 image One of my friends from $BIRBSITE posted this and I am dyingggggggg
Content warning: my take on the xz backdoor
Attached: 1 image When you realise that people have been *planning* shitty jokes like this just for one day, for the likes
Corollary: Your adversaries' SBOMs and dependency graphs *for your infrastructure* are better than yours.
That sound you hear is a flurry of people asking ChatGPT to write a business plan to monetize the XZ incident.
I really can only shitpost about the #xv debacle because the whole thing just makes me tired and sad. Anyone paying even a tiny bit of attention to the conversation about open source sustainability could have told you this was inevitable. And now we're watching people blame a volunteer trying to step back, and rehashing all the same old tired arguments we've been having literally for decades. It's just so tired and predicable and boring and sad.
so do alice and bob ever fuck or like what
My favorite Ren Faire story: I knew a guy who kept a Starfleet insignia pinned to the inside of his garb. A few times per season, some folks would come to the Faire cosplaying as a Star Trek landing party, investigating a “primitive” world. He would take them aside, show his insignia, and identify himself as a Starfleet officer on a cultural research mission. He’d call them out for breaking the Prime Directive and ruining his research. Then he’d demand to know what ship they’re from, and threaten to get them court martialed if they didn’t change into something less conspicuous.
tech companies donate their april fools’ day joke budget to open source maintainers challenge 2024
Polite reminder about the Jia Tan XZ hack: if an organization is so well run and well funded that it's able to play that long a game to that degree of depth and sophistication, that organization does not have all its eggs in one basket.
When Elon Musk, JK Rowling and the cops are unhappy, you know it’s a good law that will protect people. https://www.bbc.co.uk/news/uk-scotland-68703684
There’s a combo hot take brewing in my head about the #xz and #redis debacles. It goes something like: When the shit hits the fan and part of the reason appears to be an overworked and underpaid maintainer, lots of people come out of the woodwork to demand more respect and money for them. But when a maintainer recognizes that they’re in an unsustainable situation and dares to make a proactive change, well FUCK THAT GUY. WHO THE HELL DOES HE THINK HE IS?
Anyone who thinks commit signing is the answer to malicious actors, at a time when the web of trust has been killed by a lil green verified box, is foolish. Like sure they verify that someone who can log into a particular GitHub account is the author of a commit, but that… don’t mean shit when the author is malicious 🙃
Originally a thread on Twitter about the xz/liblzma vulnerability, when I finished typing it, I realized I had a real world slice of Open Source interaction that deserved more attention.
Between and I took 11079 steps.
nation state actor maintenance of an open source project may introduce a lot of backdoors, but it also helps a lot of PRs get merged, so, it;s impossible to say if its bad or not,
You can absolutely push your development cycle to the limit, the fastest programmer with a completely comprehensive suite of tests, sure. Go for it. You will still be fundamentally hamstrung by not-fit-for-purpose tooling (JIRA), overly bureaucratic release processes, and slow deployment mechanisms. Yes, be the most efficient developer you can, work in small increments and iterate effectively, but it's just as important to remove systematic issues that hinder you and your team.
being forced to mute the word “backdoor” is queerphobic