Weston Steimel

Rather excited about this @gcve@social.circl.lu draft BCP for collaborative community updates to existing CVE records. It feels like it fills a lot of the gaps that the CVE Program has refused to address over the years. Thanks @adulau@infosec.exchange for submitting it! https://discourse.ossbase.org/t/gcve-bcp-11-community-proposed-updates-to-existing-cve-records/1110

@darakian@fosstodon.org @adulau@infosec.exchange @gcve@social.circl.lu Yeah, I get that it is a quite different approach than we have been used to, but I am optimistic it can work. We shall see. I did just add a comment to the proposal around maybe offering a view in future for those that want to trust the community curations that auto-merges them with the 0 GNA records to present a unified CVE view so that all consumers don't have to reimplement that logic. But if a particular consumer disagrees with even that view for a particular record then yeah the solution is to fork to their own namespace with an opposes or equals relationship and then prefer that data in their own feeds. I do understand the concern though, and I know you have a lot of experience with this, so I think we all really appreciate the feedback.

@gcve@social.circl.lu This looks great though! As always thanks for building so many great tools in the open!

I do not care about "growth". I care deeply about the future not being a bleak pit of despair. I would much rather investments go towards things with little, no, or even negative return that actively improve the situation for future generations. Things like community owned renewable energy generation, cooperatives, repair cafés, and libraries.

@andrewnez@mastodon.social Yeah, I think I stopped after scanning about 10 GitHub repositories and realised I probably didn't want to know any more.

@whitequark@social.treehouse.systems I managed to rollback fine and then adjusted the publishing processes to use git-pages-cli locally to publish the rendered content rather than pushing to long-lived branches in git. That then allowed me to reupgrade the site to git-pages, and should hopefully also save storage costs for Codeberg since we will now be able to move from three distinct branches storing all of the content to just one (although I've noticed in the past that it seems like garbage collection never runs on the server side or something?). I may look into figuring out CI in the future to avoid the need for long-lived deploy tokens, but this works for now.

I did run into one more issue after the second upgrade which was that some redirects stopped working, but I was able to find from reading the git-pages documentation that I just needed to add ! after the http codes in the _redirects file to force using redirects over any existing route content, and it all started working as expected again.

Thanks again for all of the effort that has gone into this and for the helpful advice

@whitequark@social.treehouse.systems Thank you! I will give it a try this evening. Really appreciate all of the work you and others are doing here and on ChiPass!

@whitequark@social.treehouse.systems Oh, seems it doesn't support files stored in git lfs though. I see that mentioned in the git-pages readme, but not in the Codeberg pages migration advice, so might be a good idea to add something there. I can try to figure out where to make a proposal for that this evening. Also, is it possible to roll back to the older server? I may have only discovered all of this after attempting and upgrade (on a test site, but still would like to get it working properly again). Maybe doing a delete of the deployment via cli or something like that?

@andrewnez Hmm, so like resources to be strip mined for the profit of a few then?

@joshbressers@infosec.exchange And using the excellent @ecosystems@mastodon.social data for it just serves as a further example of how important many of these single maintainer projects can be.

@yossarian Do you happen to know if there is already some way to enforce the empty GitHub token permissions block at the workflow level to ensure the scope is only broadened when necessary at the job level? Like a pedantic mode for zizmor excessive-permissions audit or something maybe?

And how about actually affordable housing that isn't terrible? And decent community public transport services? Health? Reinstate some railways?

@sethmlarson@mastodon.social And if you need time to work through all of the findings, consider at least forcing approvals for all external contributors (not just first time) to prevent them from executing

@gcve@social.circl.lu Is there a way to propose an alias relationship or otherwise merge two separate vendors? For instance in the current dataset we have both "Oracle" and "Oracle Corporation" with some products existing under both, and it would be useful to have some way to unify these.

@whitequark@social.treehouse.systems Yeah, totally understand the reasoning for not supporting git-lfs with git-pages. git-lfs certainly is a pain. I was just using it as I had assumed that it was the least burdensome on Codeberg infrastructure, but it is certainly possible that is an incorrect assumption on my part.