Foggy morning.
Remote
Brandon Mitchell
@bmitch@fosstodon.org
mastodon 4.7.3Docker Captain, OCI maintainer, and Go developer, working on software supply chain security.
0 Followers
0 Following
33 Posts
Joined November 03, 2022
Homepage:
GitHub:
Presentations:
Replying to
@GerardThornley@hachyderm.io @catsalad@infosec.exchange great point! Maybe I won't need my swap now.
Replying to
@bagder@mastodon.social a few from my own collection, all copied from various unknown sources.
Another emergency #Linux kernel patch is going to be coming down the pipe. Watch your distribution for security updates.
Replying to
@mattblaze@federate.social election worker here. I simultaneously believe our elections are secure, and that they are vulnerable to a fascist takeover. When the laws are followed, any fraud is easy to detect and on an individual level that won't change the outcome. /1
Replying to
@mattblaze@federate.social But if masked agents show up before the polls open, give a list of Republicans, order us to only allow those people to vote, tell us they know where we all live, and doing anything against their demands will result in masked agents busting in our doors at 3am to disappear us,... I'm not sure there are enough 60+ year old retirees willing to defy that. The few that resist may only result in their precinct being declared as invalid, which is just as good for this regime's goals. /2
Replying to
@mattblaze@federate.social the point that so many here have been making is that the laws may be good, and the system may be highly distributed, but those laws are worthless if the judicial and legislative branches keep rolling over in submission to the executive. We are becoming a country where might makes right, and it sickens me. /3
Replying to
@grono@mastodon.com.pl I realize he's crazy, but still had to verify this was real.
https://xcancel.com/elonmusk/status/2053341186530947337
Replying to
Replying to
@b0rk@social.jvns.ca @SnoopJ@hachyderm.io the "add the point" bit starts with a double quote, but ends with a parenthesis. I think it should be closed with a double quote.
Replying to
@jasonkoebler@mastodon.social this reminds me of when FTP servers allowed anonymous public uploads and forgot to restrict read access to the directory.
Take a trip down #docker memory lane.
https://cacm.acm.org/research/a-decade-of-docker-containers/
TIL that generics in Go can be used to access public variables in private structs.
Replying to
@mattblaze@federate.social "but that's illegal" isn't something that's been stopping this administration from just doing the thing first, and escalating to SCOTUS later if anyone fights it. If this administration was following the laws, I would be in full agreement with you, but we're disagreeing on the fundamentals here.
Replying to
My only critique is that it appears focused on short term grants for one-off projects, rather than providing a long term source of income for OSS maintainers. That's financially responsible for the endowment, but leaves quite the gap for OSS maintainers that need to maintain a day job to pay the bills.
Replying to
@mattblaze@federate.social there's also some precedent for the Federal government dictating how states run elections: the Voting Rights Act of 1965. I'm sure there are more than a few on the right that would love to use that precedent to takeover elections for their political motives. /4
Replying to
@oclsc@mstdn.ca election workers would be easy enough to identify (public record, face scan app), who was allowed to vote is public record, and who signed off on the election results is public record. So if the workers don't follow illegal demands of masked agents, they will know, and workers know masked agents can follow up at their convenience.
Replying to
@ploum@mamot.fr I've seen far too many LLM generated contributions, that appear to be scattered across multiple projects, with no follow up to questions. I've always assumed these are reputation farming bots, but it's entirely possible it's the result of students trying to get one PR approved, and then they abandon all the others when that happens.
At the very least, require students to have a public profile, including a link back to your class in case maintainers have feedback.
Replying to
@ploum@mamot.fr I've yet to encounter the "too many requests" error on GitHub from my own usage, though I'm aware of others reaching it with automated issue and PR generation tooling.
I wouldn't be surprised if the limit is not a single usage threshold, but based on behavior analysis from a given source. If your account is frequently accessing content that has been flagged as spam by other maintainers, that could be a trigger.
Speaking of #OCI conformance tests, if you run a container registry and want to see what's coming, give this a test with your registry and report back any issues with the test itself (or work on fixes for your registry).
https://github.com/opencontainers/distribution-spec/pull/588
I've been mostly heads down in the #OCI conformance test redesign. But I managed to ship a new #regclient release yesterday with a feature that will hopefully help the #zot registry.
Replying to
Replying to
@johannab Finally, Baha Men have an answer to their biggest question: who let the dogs out?
Replying to
@filippo@abyssdomain.expert I'm sure there's lots of flakiness happening at GitHub given all their news. But at least when I checked, the PR showed up in the list following your second link. Hopefully that means it's eventually consistent and now fixed, and not that there's a bad server you're hitting.
Replying to
@ploum@mamot.fr while I'm happy to see schools teaching OSS contributions, I worry this is creating one-off contributors similar to Hacktoberfest. From my experience, those are a net-negative for OSS maintainers.
Rather than pushing students to maintainers that didn't opt-in to be part of the classwork, consider maintaining your own OSS projects, maybe as part of another class.
Replying to
@oclsc@mstdn.ca it doesn't need to be simultaneous, and it wouldn't be every precinct. Those in red locations would still think none of this applies to them. All that's needed is to suppress the vote in enough blue precincts to flip the results in key races.