• 2 Posts
  • 947 Comments
Joined 2 years ago
cake
Cake day: July 23rd, 2023

help-circle


  • If you use the Inspect tool (click the Inspect button then a specific clue) it will give you all the necessary definitions for the clue. Would this have given you what you needed?

    If not don’t be afraid to tag me on future posts; I’m happy to help you as well.

    Going into the weekend where the puzzles get harder you’ll definitely need to use tags to figure things out. I wanted to make sure you’d seen that because I remember your frustration yesterday too.






  • Your license doesn’t support code. I’m also not really sure “Strategic Commons Defense” is a usable, defined legal framework for prose or commercial use. I also think you accidentally left your README in your LICENSE.

    Edit: Having seen your full license, this Iicense doesn’t do what you think it does. I don’t think it’s truly compatible with FLOSS licenses other than maybe stuff like WTFPL which is almost guaranteed to fail under scrutiny.





  • It’s a cynical way to view the C-staff of a company. I think it’s also inaccurate: from my limited experience, the people who run large tech companies really do want to deliver good software to users.

    From my much broader experience, this is missing the required cynicism that C-staff want to deliver software they think is good based on the criteria cynical yes staff tell them constantly is good. I’ve never met an exec that didn’t want to deliver something good; most execs I’ve met don’t actually understand what good is or how to benefit people.





  • This user wanted to audit the dependencies of cargo vet which is not shipped to an end user. It is part your toolchain in the same way your OS is. One might assume the Linux or BSD kernel has been audited; it is not reasonable to assume the UI stack has because it’s open source. It is equally unreasonable to assume the Windows anything has been audited. It is only slightly reasonable to assume parts of macOS have been audited.

    You’re only partially correct. If you are not securing the environment in which you code, your code is vulnerable to supply chain attacks. The chances are incredibly low, of course, but nonzero. You also can’t get away with, say, running your editor in a read-only image that only mounts your code because that read-only image could be exfiltrating your data.

    Edit: here’s a great example from this year; while the exploit came from a package the attack vector was social engineering. Job postings and related files are a common entry point outside of dev tools.



  • Please don’t take me as a GH shill because I’m not. I’m not sure we read the same email given your projects. Actions on GH runners are dropping in cost and there’s a new fractional cost for self-hosted. For the average user, especially those on GH runners, costs are going down. Looking at your repo, you haven’t run anything since July. Your workflow files use GH runners. Nothing in your history suggests you’re leaving the free tier so I don’t get this FUD at all. General Microsoft hate? Fuck yeah. Shitty GH service? Fuck yeah. Plenty of reasons to dunk but this was not one of them. M