lars_francke

9 ms·

91.
by lars_francke 3y ago
It might sound like nitpicking but I find it dangerous to say vulnerability == CVE. CVEs are one source of information about potential vulnerabilities but they are amongst the least reliable these days. I've heard them being called Cur
92.
by lars_francke 3y ago
Your parent is refering to the reference of "1/5/24" in the post which is the date until which you can download data. Most of the world would that interpret as 1st May 2024, some parts of the world might call it 1st Janu
93.
by lars_francke 3y ago
The things you mentioned are not solved by a typical "SBOM" but e.g. CycloneDX has extra fields to record provenance and pedigree and things like in-toto ( https://in-toto.io/ ) or SLSA ( https://slsa.dev&
94.
by lars_francke 3y ago
Haven't used mine in ages but during Corona it was super useful. My local town has Facebook groups with over 10% of the population of the town. It's super useful to get local knowledge and details on new events etc. So, yes. Still
95.
by lars_francke 3y ago
Maybe they did not apply.
96.
by lars_francke 3y ago
Maybe KDE didn't apply
97.
by lars_francke 3y ago
The Sovereign Tech Fund is awesome! We recently won funding as well (much smaller scale) https://stackable.tech/en/empowering-rust-projects/ This is definitely government spending I can get behind.
98.
by lars_francke 3y ago
I did search for E-Mail provider alternatives recently and came across a blog post by Drew DeVault: https://drewdevault.com/2020/06/19/Mail-service-provider-rec... He used to recommend mailbox.org and migadu.
99.
by lars_francke 3y ago
Everything you say is correct. I still want this. It's better than what we have today. We can work on improving things later.
100.
by lars_francke 3y ago
No, that's something different. They used to be simple to understand, looking at their homepage today I have no idea what they are doing today but not what I'm looking for.
101.
by lars_francke 3y ago
> Don't take this the wrong way but corporate are such prima donnas! Not taking it the wrong way, you're right :) > I got flashbacks from my tiny startup days when corporate went to procurement companies which wanted specifi
102.
by lars_francke 3y ago
Let's say I want to make sure to donate to ALL open source projects I use in my company. Those in my builds as well as those used on our computers that are not build dependencies (e.g. Firefox, vim, Linux, ...). How do I do that today?
103.
by lars_francke 3y ago
As others have already commented: The US government has added SBOMs to a proposed rule to update the Federal Acquisition Regulation. So if you want to sell to the US Government you'll have to provide SBOMs: https://www.feder
104.
by lars_francke 3y ago
It's my company. Apart from that: VLC was just one example. But it's a tool that a chunk of employed people actually need for work.
105.
by lars_francke 3y ago
We are using thanks.dev (to donate) and they are doing a tiny bit of it, but I have not seen much happening there in the past few months. Just sending go.mod etc. only looks at the software in the build process which doesn't go far eno
106.
by lars_francke 3y ago
I want someone to build this: SBOM (Software Bill of Materials) are slowly becoming ubiquitus around the world due to regulation. I want to be able to aggregate all SBOMs within my company, have a small tool that scans my machine and create
107.
by lars_francke 3y ago
This already exists today where you can do custom scoring and some companies (e.g. Red Hat) already do so. CVSSv4 fixes some things, yes, but not the underlying issue which isn't so much a technical challenge (partially, sure) but a sh
108.
by lars_francke 3y ago
Yes, the CVE database/process is broken. Step 1 would be to not treat vulnerability == CVE. It's a simple change in terminology but we need to make sure to communicate that CVEs are just one, probably the most popular, but just on
109.
by lars_francke 3y ago
Thanks for the heads-up, I'll keep that in mind. I've typed the last 20 years on the same keyboard and all those "clicky", "linear" etc. things don't mean much to me so I hope to benefit by just testing th
110.
by lars_francke 3y ago
I only need the four that are available for the Glove80 and they seem to be available from splitkb, excellent. Thank you!
111.
by lars_francke 3y ago
Does anyone know where I can get a switch tester from that includes all these keys? I'm in Germany. I found some but they are not for the low profile ones. I found this: https://keycapsss.com/switchestester/switch-
112.
by lars_francke 3y ago
The specs say IP55 None of my phones have been destroyed by moisture so it's not "inevitable" Which IP category does "water-proof" mean? I'm not an expert.
113.
Fairphone 5(shop.fairphone.com)
253 points by lars_francke 3y ago|258 comments
114.
by lars_francke 3y ago
Doesn't Kubernetes require a CLA?
115.
by lars_francke 3y ago
Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended. We have no idea how today's licenses will be challenged in the future and I believe it's
116.
by lars_francke 3y ago
Do similar initiatives exist for the other HashiCorp products?
117.
by lars_francke 3y ago
You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.
118.
Ask HN: Does a standard for unified Task Management across services exist?
1 points by lars_francke 3y ago|2 comments
119.
by lars_francke 3y ago
Similar organizations exist in other countries as well https://en.wikipedia.org/wiki/Stiftung_Warentest https://en.wikipedia.org/wiki/International_Consumer_Researc... I'm subscribed to the f
120.
by lars_francke 3y ago
I should expand: This happened to me twice where there was still discussion between people to find solutions for them. In both cases the majority of people accepted the answer of the maintainer but it was still unhelpful for them and they w

More ›