kjok

7 ms·

61.
by kjok 2y ago
> I've been thinking of inserting a "// THIS LINE IS MALICIOUS, PLEASE REPORT IF YOU SEE IT" in some of my projects to see how long it would take. Tools that use LLMs to review code will catch such projects.
62.
by kjok 2y ago
Are you referring to federal regulations? Would love to know the details.
63.
by kjok 2y ago
I’ve been saying that for a while. FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc. Disclaimer: I'm bu
64.
Ask HN: What can we do as a community to prevent XZ-like attacks in future?
7 points by kjok 3y ago|3 comments
65.
by kjok 3y ago
Funding FOSS projects has been a challenge; donations help, but not enough. I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on so
66.
by kjok 3y ago
Very cool! Curious to know the use cases for this tech?
67.
by kjok 3y ago
I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc. Disclaimer: I'm building a marketplace
68.
by kjok 3y ago
I've seen startups claiming to solve these with reachability analysis. I think upgrading libs regardless could be a better solution, particularly for high-risk vulnerabilities.
69.
by kjok 3y ago
> These days it's practically a necessity for companies to shell out money to some sort of supply-chain protection software (Sonatype, Socket.dev etc.) A number of some serious assumptions here. How can you be sure that you’re prote
70.
by kjok 3y ago
Building from source will be slower, but GitHub allows you to publish a package as a well.
71.
by kjok 3y ago
Why can’t you ask people to directly install from GitHub repo and skip publishing on PyPI? Curious to know.
72.
by kjok 3y ago
The proposed solution uses security policies to block/allow APIs. However, the problem is accurately figuring out such policies, not to forget the painstakingly time consuming process behind it.
73.
by kjok 3y ago
It is just a matter of time: https://pytorch.org/blog/compromised-nightly-dependency/
74.
by kjok 3y ago
Sandboxing is always good. However, the problem is figuring out accurate per-module policies (what to allow/disallow) For example, a default block-all network policy would also block legitimate functionality.
75.
by kjok 3y ago
Makes sense. However, to be able to use packages installed in $PWD (compatibility), the Docker image must be an exact replica of the host (e.g., same node version, same libs such as libcrypto) Besides, bins installed under ~/.local or
76.
by kjok 3y ago
I understand the benefits of VM/Docker based isolation. But, how to efficiently share data across boundaries and still stay protected? How can a development VM protect against malicious NPM packages that steal sensitive data (e.g., sec
77.
by kjok 3y ago
I truly believe that the increasingly growing awareness around "supply chain" security presents a fantastic opportunity for FOSS maintainers to gain financial independence and sustain their projects by selling security assurance t
78.
by kjok 3y ago
> Whereas the community is attracted towards FOSS in order to not pay… Community comes together to co-create value for everybody, which in itself is some sort of tangible currency. But a very high number of FOSS libraries/packages D
79.
by kjok 3y ago
This is a good suggestion. I assume you mean FOSS maintainers can create a variant (package?) that's optimized for performance. I'd thought of a similar variant, but for telemetry based on the recent Moq incident https:/&#x2
80.
Ask HN: FOSS maintainers, what can you "sell" to sustain and earn a living?
16 points by kjok 3y ago|21 comments
81.
by kjok 3y ago
Sure. The plan is to provide security assurance to the consumers on software contents, packaging, governance, etc..
82.
by kjok 3y ago
I truly believe that open-source developers can gain financial independence by selling supply-chain security. Disclaimer: I'm exploring this idea.
83.
Ask HN: How do you handle kernel security patches?
3 points by kjok 3y ago|0 comments
84.
by kjok 3y ago
And "governance structures" is exactly what FOSS maintainers can sell.
85.
by kjok 3y ago
I truly believe that all this awareness around "supply chain" security is a fantastic opportunity for FOSS maintainers to gain financial independence.
86.
by kjok 3y ago
What's the reason for the high inference latency? Any ideas on how this could be improved?
87.
by kjok 3y ago
Great job on Gdańsk AI! How do you handle the speech-text/API latency? Coincidentally, I'm working on an idea that is similar to your other project https://poss.market/market/ How's it going? Would love
88.
Ask HN: Why is open source vulnerability management still an unsolved problem?
3 points by kjok 3y ago|1 comments
89.
Ask HN: Why is open source vulnerability management still an unsolved problem?
5 points by kjok 3y ago|1 comments
90.
by kjok 4y ago
> Everyone should quit, get ahead of the layoffs, useless company. Your work there makes the world a worse place. You can do better. This is everything I wanted to say about FB. Always wondered why so many talented folks (with PhDs) choo

More ›