lrvick

18 ms·

451.
by lrvick 6mo ago
I deeply hate Sam Altman, but after reading the flagged comments. Jesus. You do a tough job. Thank you.
452.
by lrvick 6mo ago
Meanwhile I expect that intellectual property protections for software are completely unenforceable and effectively useless now. If something does not exist as MIT, an LLM will create it. The playing field is level now, and corpo moats no l
453.
by lrvick 6mo ago
Soon they will have to boycott all of them. Then what I wonder?
454.
by lrvick 6mo ago
It cannot be understated how religiously opposed many in the Linux community are to even a single AI assisted commit landing in the kernel no matter how well reviewed. Plenty see Torvalds as a traitor for this policy and will never contribu
455.
by lrvick 6mo ago
In my experience government just uses RedHat which is -not- reproducible and -not- full source bootstrapped so a single person in the supply chain could maliciously or accidentally backdoor everything. Maybe the goal of the supply chain att
456.
by lrvick 6mo ago
Let me start by saying I love rust, but the supply chain story for official rust compiler binaries is not okay and I would never even trust them even on a dev workstation, let alone in production. Most people get rust from rustup, an unsign
457.
by lrvick 6mo ago
NASA describes some impressive work for runtime integrity, but the lack of mention of build-time security is surprising. I would expect to see multi-party-signed deterministic builds etc. Anyone have any insight here?
458.
by lrvick 6mo ago
We are seeking a design that works across every VCS, mirror, or vendored copy of code by generating a universally stable SWHID across all distribution methods of a given version of software source code. The goal being you can just request s
459.
by lrvick 6mo ago
There are piles of examples of it working for complex projects and libraries now especially if they have good test suites your clone can pass. Also they are even getting quite good at reverse engineering binaries. Anything not released as F
460.
by lrvick 6mo ago
> I think it matters if you want to call it a WoT. But also, I don't think any signatures originating from these keys are being verified usefully at any meaningful scale. Web of trust is a web of mutually trusting keys, not a networ
461.
by lrvick 6mo ago
I was just calling them by their new name, but yes clearly I am not the biggest fan of OpenAI and me invoking their name so soon betrays that. Sam altmans vision for handling the "proof of human" problem WoT solves is having every
462.
by lrvick 6mo ago
I am deeply aware of Moxies views on this, and we have talked about them at length, and he is wrong. Also SKS and GnuPG are not OpenPGP. GnuPG no longer conforms to modern OpenPGP standards and is the IE6 grade implementation that we should
463.
by lrvick 6mo ago
If you have deterministic full source bootstrapped builds, it gets pretty simple and all of the third party trust can go away. You build it, I build it, we get the same hash. It allows anyone to prove a published binary is a faithful compil
464.
by lrvick 6mo ago
> NOONE (beside google) is going to do that. Its too costly, you need two big teams just to handle that one part. And yet my team and I at stagex are building a decentralized code review system to handle this anyway. Not waiting around w
465.
by lrvick 6mo ago
You can call it dead, and yet, it is the only system signing internet infrastructure at scale right now because of Debian, Suse, Fedora, Arch, Gentoo, Ubuntu, Redhat, etc. It is very much alive for those use cases that need it most. If one
466.
by lrvick 6mo ago
The biggest problem with crev is it is (last I checked) entirely centralized on git/github making it not all that useful for early supply chain dependencies that often just live on random tar files on servers, or svn, or cvs, or mercur
467.
by lrvick 6mo ago
Sure, individual maintainers offer general purpose consulting services, but if we all did that for the next 20 years to keep the lights on we will never make a tiny fraction of the money we could have made by paywalling the binary artifacts
468.
by lrvick 6mo ago
You definitely trust the same web of trust key graph already in every single layer of your current CI solution. Everything at Astral and by all indications also OpenAI is built with third party services, third party (blind) signing, using t
469.
by lrvick 6mo ago
I promise we are actively working on a much better solution we hope any distro can use, but... for now we just enforce signed merge commits by a different maintainer other than the author as something they only do for code they personally r
470.
by lrvick 6mo ago
The only binaries of uv in the world you can get that were full source bootstrapped from signed package commits to signed reviews to multi-signed deterministic artifacts are the ones from my teammates and I at stagex. All keys on geodistrib
471.
by lrvick 7mo ago
It is clear the options are either we get better at decentralized trust and decentralized identity recovery, or we all just sit around and wait for a centralized corporation to decide what identity is online, and what minimum security level
472.
by lrvick 7mo ago
I had a doctor tell me that I had to buy an Android or iOS phone (I own neither) and install their new app, or they would be unable to continue seeing me as a patient. Found a new doctor, because anyone that thinks this way I do not trust m
473.
by lrvick 7mo ago
> (1) package distribution has nothing to do with git It does in stagex, and could in any project. The same maintainer keys that sign commits and reviews are the same keys that must sign releases. > (2) this doesn’t easily account fo
474.
by lrvick 7mo ago
My 7 teammates and I on stagex actually maintain all this zero-trust signing and release process I am suggesting for several hundred packages and counting. Not asking anyone to do hundreds like my team and I are, but if authors could just a
475.
by lrvick 7mo ago
If the keys that signed the early commits of a trusted FOSS project suddenly change without being signed by the previous keys, that should merit a higher level of consensus at release time, or waiting periods, etc. Identity continuity at a
476.
by lrvick 7mo ago
Of course, which is why all the (decent) tooling for this is provider agnostic, and provides documentation for multi-party-sharded backups so a quorum of maintainers can always re-assemble the key by hand for any reason if needed.
477.
by lrvick 7mo ago
Simply supporting passkeys gives people domain locked login via qr/phone, or any fido2 usb device. No more keyboard entry required for login other than username, which means phishing is off the table. Standards are great if we can get
478.
by lrvick 7mo ago
They also forced OpenCode to remove support as well. Thankfully there is always self hosting and a shit ton of competitors that let you use whatever local software you want.
479.
by lrvick 7mo ago
What they need to mandate is hardware anchored passkeys/fido2/webauthn for both auth and package signing, with the -option- to sign with PGP for those that have well trusted PGP keys. They won't do this, I have talked to them
480.
by lrvick 7mo ago
A $50 used laptop from goodwill and a $40 yubikey will do the job. If maintainers really cannot afford that, they should flag it as a major big bold print supply chain risk on the readme: "We cannot afford 4 yubikeys for our maintainer

More ›