lrvick

25 ms·

601.
by lrvick 10mo ago
I look forward to seeing them in court for trying to force me to accept Google or Apple terms of service.
602.
by lrvick 10mo ago
I absolutely torrent as a way to discover new content, but I want favorites on a shelf on very long shelf life media where it does not require internet access and is never going to get altered or deleted as streaming services often do, or e
603.
by lrvick 10mo ago
Do not give netflix -too- much credit for this. Netflix permanently closes distribution of most content they touch and kills the very physical media ownership options for content that they built their empire on. You will be hard pressed to
604.
by lrvick 10mo ago
I just got rid of my smartphone, which forces me to spend a lot more time thinking when I am not at home. Would highly recommend.
605.
by lrvick 10mo ago
Personally I open source things often specifically to kill the value proposition of companies trying to keep people in their walled gardens.
606.
by lrvick 10mo ago
NixOS made a decision to tolerate single party supply chain security to support as many packages as possible even if it means nixos cannot be used for high security applications. This is a perfectly acceptable stance IF they communicate the
607.
by lrvick 10mo ago
> I work in Google Ads infrastructure in the past four years I am glad they were up front about this. Saved me a read.
608.
by lrvick 10mo ago
Correction: meant to say Alpine and Nix skip key management unlike all other major distros.
609.
by lrvick 10mo ago
Simply do not distribute it in a distro recommended for high security applications.
610.
by lrvick 10mo ago
> The convention is now not to do that. I believe a maintainer recently had their commit bit revoked due to doing this. I don't know why it isn't enforced, but it should be. Unless you actually know who is committing code and w
611.
by lrvick 10mo ago
Just a couple examples off the top of my head I have bumped into: Packages that cannot be full source bootstrapped like Haskell are allowed, so total trust is placed in a third party compiler binaries. Also in cases like qemu where binary b
612.
by lrvick 10mo ago
Yet another reminder that Nix does not sign commits, does not sign reviews, allows any maintainer to merge their own code, does not compile all packages from source, and Hydra admins can absolutely tamper with builds at any time. It is a ma
613.
by lrvick 10mo ago
No tube manufacturers exist, though some refurbish old tubes and pair them with new electronics.
614.
by lrvick 10mo ago
I have the second largest, and 25 others, hooked up in my garage, fed by a modular synth, a pc, retro consoles, and several DVD and VHS players. Would still probably trade it all for one of these. CRTs are literally precision particle accel
615.
by lrvick 10mo ago
Eliminating Mes would be amazing for us in Stagex. Mes is the second longest build in the entire tree (after rust).
616.
by lrvick 10mo ago
I hear you, and if I was given such an order, even if it came with a gag order, I would never comply and would go straight to the press, consequences be damned. Problem is everyone knows the people like me that would react this way, and tho
617.
by lrvick 10mo ago
At Distrust we do not comment on specific dependency CVEs unless they are likely exploitable, or there are a lot of them pointing at bigger problems in the overall approach to dependency management. That said, a policy of blindly updating d
618.
by lrvick 10mo ago
We have never issued a clean report in our ~5 years of operation. Some firms have a reputation for issuing clean reports that look good to bosses and customers, but we prefer working with clients that want an honest assessment of attack sur
619.
by lrvick 10mo ago
You do not need a custom buildkit frontend to do reproducible builds with any modern container build system, including docker. Vanilla docker/buildkit works just fine as we use it in Stagex with just makefiles and Containerfiles which
620.
by lrvick 10mo ago
If we put out our own tar of all the sources, who is to say we did not tamper with them? This is a bit of a lose/lose but we have a solution we are working on with other distros to have a shared repository for all these, often legacy,
621.
by lrvick 10mo ago
We normally find things like this in our usual 60 hour audit blocks. Rates change over time with demand, but today an audit of that length would be $27k. Even that is quite cheap compared to letting a blackhat find this.
622.
by lrvick 10mo ago
I run an infosec firm and we have done attacks like this on my clients over and over and over in audits. I always say any bored teen could do most of what we do because most companies are moving too fast feature farming to have any time for
623.
by lrvick 10mo ago
For anyone that wants dead simple LFS style, full source bootstrapped, deterministic, multi-party compiled/signed container native images with hash pinning for your entire dependency graph, that will be free forever, check out stagex.
624.
by lrvick 10mo ago
I think free education is fantastic for society and would vote for that every time, taxes be damned. But until then we in the US live in a capitalist hellscape where we have to prioritize survival which means only focusing on marketable ski
625.
by lrvick 10mo ago
I would agree FAANGs are an exception who have historically hired almost exclusively academics who hire other academics, and it shows. They let many coast for years at a time and get away with being a specialist unable to deliver value outs
626.
by lrvick 10mo ago
> motivation, discipline and resourcefulness In my experience those that lack these do not have chance in tech in the first place, so save yourself lot of debt.
627.
by lrvick 10mo ago
Unfortunately if it takes you 4 years to significantly upskill in tech, you are learning way too slow to survive in this industry. Most of the major innovators I know are dropouts, because they realized college is suited to train you to wor
628.
by lrvick 10mo ago
I would remind everyone that lots of free solutions like Forgejo exist with much better security posture.
629.
by lrvick 10mo ago
Probably, but it would increase my reliance on single point of failure device I have no control of and I would have to pay to support the current corrupt cellular network industry which is not appealing to me.
630.
by lrvick 10mo ago
My daily driver laptops and desktops, a payphone, and a number of DECT phones.

More ›