4 ms·

TL;DR turn on signed commits and 2FA, don't commit secrets, and be careful with dependency vulnerabilities. Doesn't really seem like "a ton of work".

• stoplying1 4y ago
  So much advice these days is "do what you're supposed to do instead of being lazy and it works out!".
• bombolo 4y ago
  • z33k 4y ago
    > Docker Containers You could set up trivy.dev scanning as part of your CI pipeline. Patch until your builds are green again :)
    • bombolo 4y ago
      What if I'm a user of a container?
      • bombolo 4y ago
        I tried it on some random containers. It gave me "returned an error". That's it. No details, no nothing. Doesn't seem something worthy of investing my time into.
  • stoplying1 4y ago
    It's called CI. Gasp. You know, the thing you need if you're stuck in 2000's eea deployments. Or the thing you need if you're deploying VMs. Or the thing you need if you're deploying containers. "You know*, the thing you need if you give a shit about your product. Oh wait, what, you're running a live service, connected to public internet? And you somehow think "lol gotcha rust updates are a thing" is an own? Once again, y'all keep tattling on yourselves!! While acting so smug, I (really don't) need some of that ignorant confidence! *Please!!!!* Feel free to link us to your running live services that you apparently can't run CI/CD for. Its totes fine, right?
    • bombolo 4y ago