4 ms·

snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 https://github.com/snyk/c

by guappa 2y ago

snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 https://github.com/snyk/cli/pull/5649 They also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Their competence isn't as big as their fame, in my opinion. Also one of their sales people insulted me over email, because apparently not being interested in buying their product means you're an incompetent developer who can only write software filled with vulnerabilities.

gyoridavid 2y ago
"insulted me over email" - whoa, that's wild, do you still have the email? would be fun to see it :D
- guappa 2y ago
  Sorry, I searched, it seems all my emails from before the last company rename are gone. edit: or microsoft outlook sucks… I tried to sort in reverse my inbox to see what's the oldest email there and "the request cannot be satisfied"
  - unixhero 2y ago
    Ouch, I kind of trusted it. ... more than Gmail and Google
- ceejayoz 2y ago
  I get surprisingly many cold emails these days with a passive aggressive “shall we schedule a call, or are you a bad person who doesn’t give a shit about security?” approach.
  - matwood 2y ago
    Yeah. Or 'make this change to help our processes'. Um, that's not my job.
bilekas 2y ago
> hey also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Well theres a sign of a good team.. /s That's actually an interesting take, I haven't heard too much about them except that they do have an ego.
Ylpertnodi 2y ago
I'm sure you can provide the body of the [appropriately redacted] said email?
- guappa 2y ago
  I was also sure until I found out that outlook refuses to search old emails.
  - throw16180339 2y ago
    There's an additional hoop to jump through for Outlook to actually search your whole inbox. Here are the steps (https://answers.microsoft.com/en-us/outlook_com/forum/all/outlook-search-dont-show-me-new-ones/38ce11fd-176b-4ebe-b577-89cdcce51e3c https://answers.microsoft.com/en-us/outlook_com/forum/all/ou...)
azemetre 2y ago
They also penalize libraries that are "done," and require minimal development. Completely backwards software that corpos only seem to buy because their insurers force them to check off some security list box.
alp1n3_eth 2y ago
That's extremely unfortunate, especially about the "abandoned" labelling. I've been looking to move off GitHub recently as well, it feels like it's got a bit too much control. Codeberg looks interesting, and there are self-hosted ones like Forejo that also look great if you're okay with the maintenance.
- guappa 2y ago
  I use codeberg :) It has CI, pull requests, issues and whatnot. It also doesn't force you to use 2fa if you don't want :D If you do corporate open source though, you're stuck on github because snyk, openssf, pypi and whatnot only interface with github. For actual libre software codeberg is very good. Keep in mind that debian salsa is open to everyone as well. The only annoyance is that non debian developers have a "-guest" suffix. But it's ok to use for projects that aren't debian specific.

by guappa 2y ago

gyoridavid 2y ago

"insulted me over email" - whoa, that's wild, do you still have the email? would be fun to see it :D

guappa 2y ago
Sorry, I searched, it seems all my emails from before the last company rename are gone. edit: or microsoft outlook sucks… I tried to sort in reverse my inbox to see what's the oldest email there and "the request cannot be satisfied"
- unixhero 2y ago
  Ouch, I kind of trusted it. ... more than Gmail and Google
ceejayoz 2y ago
I get surprisingly many cold emails these days with a passive aggressive “shall we schedule a call, or are you a bad person who doesn’t give a shit about security?” approach.
- matwood 2y ago
  Yeah. Or 'make this change to help our processes'. Um, that's not my job.

bilekas 2y ago

> hey also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Well theres a sign of a good team.. /s That's actually an interesting take, I haven't heard too much about them except that they do have an ego.

Ylpertnodi 2y ago

I'm sure you can provide the body of the [appropriately redacted] said email?

guappa 2y ago
I was also sure until I found out that outlook refuses to search old emails.
- throw16180339 2y ago
  There's an additional hoop to jump through for Outlook to actually search your whole inbox. Here are the steps (https://answers.microsoft.com/en-us/outlook_com/forum/all/outlook-search-dont-show-me-new-ones/38ce11fd-176b-4ebe-b577-89cdcce51e3c https://answers.microsoft.com/en-us/outlook_com/forum/all/ou...)

azemetre 2y ago

They also penalize libraries that are "done," and require minimal development. Completely backwards software that corpos only seem to buy because their insurers force them to check off some security list box.

alp1n3_eth 2y ago

That's extremely unfortunate, especially about the "abandoned" labelling. I've been looking to move off GitHub recently as well, it feels like it's got a bit too much control. Codeberg looks interesting, and there are self-hosted ones like Forejo that also look great if you're okay with the maintenance.

guappa 2y ago
I use codeberg :) It has CI, pull requests, issues and whatnot. It also doesn't force you to use 2fa if you don't want :D If you do corporate open source though, you're stuck on github because snyk, openssf, pypi and whatnot only interface with github. For actual libre software codeberg is very good. Keep in mind that debian salsa is open to everyone as well. The only annoyance is that non debian developers have a "-guest" suffix. But it's ok to use for projects that aren't debian specific.