guappa

65 ms·

961.
by guappa 2y ago
Reddit depends very much on which subreddit you are. There's plenty of racists, trump supporters and so on on reddit.
962.
by guappa 2y ago
It was a plural you. I have no idea who you personally are.
963.
by guappa 2y ago
They even got some public money from Germany's sovreign tech fund to couple uploads with gigantic USA companies. This is probably deserving a criminal investigation since it appears the funds were probably misused? Well done guys! Good
964.
by guappa 2y ago
Lucky you :D I was talking about non-work accounts that don't belong to organizations. Mine got forced to use 2fa a long time ago.
965.
by guappa 2y ago
It doesn't seem to be from what I can see. Only states that the upload came from a gh runner.
966.
by guappa 2y ago
I can create a github account. How does that make me trustworthy? How being able to create a github account prevents me from adding a virus in my module?
967.
by guappa 2y ago
Good luck with that…
968.
by guappa 2y ago
None. Developer machine will have ssh keys and github tokens that can be used to push a commit on github, that will be built, signed, and uploaded on pypi.
969.
by guappa 2y ago
> to virtually no complaint since nobody was actually verifying any of the signatures And this is in no way a consequence of pypi stopping to host public keys right? Say the whole story at least… Say that there used to be a way to verify
970.
by guappa 2y ago
Ping me when one of them will be an open source entity rather than a company.
971.
by guappa 2y ago
How does pypi know I'm not github? Because I can sign with my keys and not with github's key. Never mind all the low level details of the temporary keys and hashes and all of that. This is an high level comment not a university bo
972.
by guappa 2y ago
You don't. The whole point is that you can no longer sign anything. Microsoft signs for you. And of course the signature means "this user can push to github" and nothing more.
973.
by guappa 2y ago
Try to run your own gitlab instance and use this to publish. See what happens… At this moment this only supports github.
974.
by guappa 2y ago
> error-prone cryptographic bits if they don't need to They can't. Because you wouldn't accept their key anyway.
975.
by guappa 2y ago
Except that also for trusted publishing, they only allowed github in the beginning and eventually added a couple of other providers. But if you're not google or microsoft you won't be added.
976.
by guappa 2y ago
Only once… but if they can get your forever token… that's not the same.
977.
by guappa 2y ago
You're claiming here that you do a review of all of your dependencies?
978.
by guappa 2y ago
I still remember the numbers I used as a kid. Anyway now as an adult I have to remember a lot of pin codes. * Door to home * Door to office * Door to gf's place * Bank card #1 * Bank card #2 * Bank card #3 * Phone #1 * Phone #2
979.
by guappa 2y ago
AI comes to write it 10x longer so you pretend you worked a lot and think the reader can't realise your report is just meaningless words because you never read anything yourself.
980.
by guappa 2y ago
Brace yourself, people who are going to come to tell you that it was all your fault are here! I got bullied at a conference (I was in the audience) because when the speaker asked me, I said AI is useless for my job. My suspicion is that the
981.
by guappa 2y ago
I moved to codeberg and there's nothing of the sort going on there. Quite relaxing. On github I did get weird and suspicious contributions.
982.
by guappa 2y ago
Not unique. Bitcoins were stolen with a similar technique of highjacking a js dependency of some bitcoin wallet app. It was done by doing proper contributions at first to gain control of the thing. They were even better, the library behaved
983.
by guappa 2y ago
Well linux distributions can be installed on windows so…
984.
by guappa 2y ago
Ah yes I'm sure it's completely impossible to game these services by printing a fake id at home and showing it on the webcam /s
985.
by guappa 2y ago
Nah. A year maybe?
986.
by guappa 2y ago
Blame it on go dependency lists and similar. What do you even review when it's one of those? There's thousands of lines changed and they all point to commits on other repositories. You're essentially hoping it's fine.
987.
by guappa 2y ago
2FA matters very little when you have never expiring tokens.
988.
by guappa 2y ago
But github gets an higher evaluation having X amount of active users. The last thing they want is to make that number drop! By the way on gh you can also buy stars for your project from fake accounts.
989.
by guappa 2y ago
Well they do get home!
990.
by guappa 2y ago
So how do you go from 0 experiments to 10000000 experiments without passing from 1 experiment? Care to explain? Perhaps if you're at 0 experiments you can't really have an opinion? Which is the situation of the person I replied to

More ›