[…some time later…]
“heya, I’m back!!”
“oh hey how’d it g- babe I thought I told you to change your eyeliner, you know how badly the cheap stuff runs”
“yeah, I know…”
“wait, are those bruises?! …I’m gonna guess you didn’t get the job?”
“I start Monday!”
“Now obviously for this position we’re expecting some amount of frontend experience… it says here you’re familiar with manipulating the DOM, would you tell us a little more about that?”
The candidate smirked.
“Make me.”
Attached: 3 images
Join us at State of Open Con, where open source innovators unite to tackle challenges across software, data, and hardware. OpenSSF is excited to be part of the conversation today and tomorrow! 💬
#OSSSecurity
@openuk@hachyderm.io @Omkhar@infosec.exchange
It does blow my mind that I'm at the point of my life where I can see someone doing what I was doing a DECADE ago (tbh more) and me thinking "oh you have no idea"
Quantifying your reliance on #OSS by
@www.jvt.me@www.jvt.me
They started to create a dependency tree to determine whether they should take part in #hacktoberfest. But it's not always ☀️🌈 as in some cases all depends on a very fragile library ([xkcd comic#2347](https://xkcd.com/2347/))
Understanding how your business depends on software is important from a few points:
- how am I affected by migrating away from #OpenSource
- usage of unwanted libraries
- understand usage of libraries and their versions
- discover unmaintained, deprecated or vulnerable software
But all that applies to #InnerSource too!!
- how maintained are the dependencies?
- how are the security practices followed in the supply chain?
How can we do it? It can be done using #OpenSource with dependency-management-data https://dmd.tanna.dev/ with a CLI and web interface. It uses a #sqlite db, and provides a graphQL api too. And without vendor locking!
Dependabot API helped him to get some insights to know where contribute that were helpful to the company he was working. But it was not enough information. endoflife.date helped him to find what's soon to expire and other similar websites for other info. `dmd` helps in an easier way and it uses #renovate and other tools and services to get all the data for the model.
Then you can query the db with what you are interested. It comes with some pre-baked queries.
For #InnerSource you could define advisories and policies for when you don't have open APIs to query for that information. For example, flag when some software is using an old git server instance or set a set of code owners, or how many customer facing is using an outdated dependency.
Their [website has some case studies with more examples](https://dmd.tanna.dev/case-studies/).
#SOOCON24
Attached: 1 image
went on a stupid short mental health walk for my stupid mental health in the stupid rain getting stupid wet in the stupid grey outside
Another thing I am begging of people who make APIs: When you include sample code in the docs, include the "using"/"use"/"import"/"#include" statements. Please. Please. I just pasted this inline sample code https://mlem.ellpeck.de/articles/ui.html#setting-it-up into my hello world program, and it's failing because the symbol "UntexturedStyle" could not be found. "Are you missing a using directive or an assembly reference?", asks dotnet. Yeah, probably?? because you didn't tell me what using directives I needed?!?
Attached: 1 image
Government urged to fix NHS waiting lists after King Charles spends 24 hours on trolley in hospital corridor https://newsthump.com/2024/02/05/government-urged-to-fix-nhs-waiting-lists-after-king-charles-spends-24-hours-on-trolley-in-hospital-corridor/