3 ms·

This escalator is temporarily stairs, sorry for the convenience.

Akronymus 11mo ago
Tbh, I personally don't trust a stopped escalator. Some of the videos of brake failures on them scared me off of ever going on them.
- collingreen 11mo ago
  You've ruined something for me. My adult side is grateful but the rest of me is throwing a tantrum right now. I hope you're happy with what you've done.
  - rvnx 11mo ago
    I read a book about elevators accidents; don't.
    - yjftsjthsd-h 11mo ago
      elevators accidents or escalator accidents?
      - rvnx 11mo ago
        elevators. for escalators, make sure not to watch videos of people falling in "the hole".
        deleted 11mo ago
        [deleted]
    - Akronymus 11mo ago
      With people properly using them or not? I am fairly certain that the vast majority comes from improper use (bypassing security measures, like riding on top of the cabin) or something going wrong during maintenance.
  - Akronymus 11mo ago
    I am genuinly sorry about that. And no, I am not happy about what I've done.
fishpen0 11mo ago
Not really comparable at any compliance or security oriented business. You can't just zip the thing up and sftp it over to the server. All the zany supply chain security stuff needs to happen in CI and not be done by a human or we fail our dozens of audits
- __MatrixMan__ 11mo ago
  Why is it that we trust those zany processes more than each other again? Seems like a good place to inject vulnerabilities to me...
  - cyberax 11mo ago
    Hi! My name is Jia Tan. Here's a nice binary that I compiled for you!
  - goku12 11mo ago
    This isn't really a trust issue. People tend to take shortcuts and commit serious mistakes in the process. Humans are incredibly creative (no, LLMs are nowhere close). But for that, we need the freedom to make mistakes without serious consequences. Automation exists to take away the fatigue of trying to not commit mistakes.
    - __MatrixMan__ 11mo ago
      I'm not against automation at all. But if all of the devs build it and get one hash and CI runs it through some gauntlet involving a bunch of third party software that I don't have any reason to trust and out pops an artifact with a different hash, then the CI has interfered with the chain of trust between myself and my user. Maybe I've just been unlucky, but so far my experience with CI pipelines that have extra steps in them for compliance reasons is that they are full of actual security problems (like curl | bash, or like how you can poison a CircleCI cache using a branch nobody reviewed and pick up the poisoned dependency on a branch which was reviewed but didn't contain the poison). Plus, it's a high value target with an elevated threat model. Far more likely to be attacked than each separate dev machine. Plus, a motivated user might build the software themselves out of paranoia, but they're unlikely to securely self host all the infra necessary to also run it through CI. If we want it to be secure, the automation you're talking about needs to runnable as part of a local build with tightly controlled inputs and deterministic output, otherwise it breaks the chain of trust between user and developer by being a hop in the middle which is more about a pinky promise and less about something you can verify.

Tbh, I personally don't trust a stopped escalator. Some of the videos of brake failures on them scared me off of ever going on them.

collingreen 11mo ago
You've ruined something for me. My adult side is grateful but the rest of me is throwing a tantrum right now. I hope you're happy with what you've done.
- rvnx 11mo ago
  I read a book about elevators accidents; don't.
  - yjftsjthsd-h 11mo ago
    elevators accidents or escalator accidents?
    - rvnx 11mo ago
      elevators. for escalators, make sure not to watch videos of people falling in "the hole".
      - deleted 11mo ago
        [deleted]
  - Akronymus 11mo ago
    With people properly using them or not? I am fairly certain that the vast majority comes from improper use (bypassing security measures, like riding on top of the cabin) or something going wrong during maintenance.
- Akronymus 11mo ago
  I am genuinly sorry about that. And no, I am not happy about what I've done.

fishpen0 11mo ago

Not really comparable at any compliance or security oriented business. You can't just zip the thing up and sftp it over to the server. All the zany supply chain security stuff needs to happen in CI and not be done by a human or we fail our dozens of audits

__MatrixMan__ 11mo ago
Why is it that we trust those zany processes more than each other again? Seems like a good place to inject vulnerabilities to me...
- cyberax 11mo ago
  Hi! My name is Jia Tan. Here's a nice binary that I compiled for you!
- goku12 11mo ago
  This isn't really a trust issue. People tend to take shortcuts and commit serious mistakes in the process. Humans are incredibly creative (no, LLMs are nowhere close). But for that, we need the freedom to make mistakes without serious consequences. Automation exists to take away the fatigue of trying to not commit mistakes.
  - __MatrixMan__ 11mo ago
    I'm not against automation at all. But if all of the devs build it and get one hash and CI runs it through some gauntlet involving a bunch of third party software that I don't have any reason to trust and out pops an artifact with a different hash, then the CI has interfered with the chain of trust between myself and my user. Maybe I've just been unlucky, but so far my experience with CI pipelines that have extra steps in them for compliance reasons is that they are full of actual security problems (like curl | bash, or like how you can poison a CircleCI cache using a branch nobody reviewed and pick up the poisoned dependency on a branch which was reviewed but didn't contain the poison). Plus, it's a high value target with an elevated threat model. Far more likely to be attacked than each separate dev machine. Plus, a motivated user might build the software themselves out of paranoia, but they're unlikely to securely self host all the infra necessary to also run it through CI. If we want it to be secure, the automation you're talking about needs to runnable as part of a local build with tightly controlled inputs and deterministic output, otherwise it breaks the chain of trust between user and developer by being a hop in the middle which is more about a pinky promise and less about something you can verify.