lrvick

33 ms·

781.
by lrvick 1y ago
Even that annoys me because who knows how accurate that is at any moment. Wikipedia is great for getting a general intro to a thing, but it is not a source. I would rather people go find the actual whitepaper or source in the footnotes and
782.
by lrvick 1y ago
I do not use AI for engineering work and never will, because doing the work of thinking for myself is how I maintain the neural capacity for forming my own original thoughts and ideas no AI has seen before. If anyone gives me an opinion fro
783.
by lrvick 1y ago
It is way behind Debian on even the basics sadly. Maintainers do not even sign in NixOS making them easy to impersonate. Debian security is a joke too though in other areas, and like nix, should never be used in production either. See a sec
784.
by lrvick 1y ago
I ultimately thought out what would be easier, a decade political fight to make massive changes to nix, or a fork of it written solo to improve auditability and security, or starting over from the top with a design that checks every dream b
785.
by lrvick 1y ago
You absolutely should never trust a centralized build server. Any security critical software distribution process should have all packages independently built, verified to have identical hashes, and signed by systems controlled by as many d
786.
by lrvick 1y ago
Sorry to be that guy, but if someone cannot afford a $10 bit of hardware for the most basic attempt at protecting others from being harmed by someone impersonating them... then they have no business being a trusted maintainer in a Linux dis
787.
by lrvick 1y ago
My RFC was much earlier in 2018 https://github.com/NixOS/rfcs/pull/34 Lack of supply chain integrity controls as a means to reduce contribution friction to maximize the number of packages contributed is a per
788.
by lrvick 1y ago
Had the Nix team rolled out signed commits/reviews and independent signed reproducible builds as my (rejected) RFC proposed, then it would not be possible to do any last mile supply chain attacks like this. In the end NixPkgs wants to
789.
by lrvick 1y ago
Well at the point you give up your phone you are already inches away from having near zero location data brokers can purchase, if you also use cash. Pretty great privacy win on top of the mental health wins.
790.
by lrvick 1y ago
In the 5 years since giving up a smartphone I started a new generation Linux Distro from 0, started a security consulting company, made hires, traveled the world, and learned several completely new skills, while having a fairly active famil
791.
by lrvick 1y ago
As the original author of the current generation of the Pebble Appstore back in Pebble early days, I made a very intentional decision to move almost all logic client side to make it easy for people to archive and self host with their own AP
792.
by lrvick 1y ago
Every decent malware author just adds tools like these to their test suites, and only release new malware that evades all detection. That game of cat and mouse never ends. The only solution is just actually reviewing the code we ship to our
793.
by lrvick 1y ago
Here is the entire guide you need to protect yourself from supply chain attacks as a software engineer. Pick whichever of these will consume the fewest resources over time: 1. review an existing library and all dependencies, and all securit
794.
by lrvick 1y ago
"Verifying you are human. This may take a few seconds."... over and over and over. I assume this is supposed to actually do something eventually, but now I think it is just a bot tarpit.
795.
by lrvick 1y ago
https://lance.dev has my mastodon etc. My friends and I also run the #! community, https://hashbang.sh #!:matrix.org
796.
by lrvick 1y ago
Keyless signing is not a real thing. Trust online is always anchored to keys, even if short lived. Keyless signing just means letting a centralized oracle blind sign for you with trust anchored in a CA key of some kind in most cases, that a
797.
by lrvick 1y ago
I full source bootstrapped a Linux distro from hex0 all the way to nodejs binaries just to deal with trusting trust risks. "just give up" is not a valid strategy. https://codeberg.org/stagex/stagex
798.
by lrvick 1y ago
I have built and shipped production web applications for many large orgs with millions of users. Used 1-2 libs tops that i reviewed myself. Also now as someone that runs a security consulting firm, we absolutely have clients that review 100
799.
by lrvick 1y ago
And then the vulnerable code will just move to shell execs in the main library that fire the next time you include the library in your project. If you do not have time to review a library, then do not use it.
800.
by lrvick 1y ago
Anyone that has production AWS creds in the same operating system they randomly execute unreviewed code on the internet on should have their access revoked.
801.
by lrvick 1y ago
pnpm cannot be built from source without an existing pnpm binary making it ineligible for inclusion in any reproducible Linux distro, for good reason, as there is no way to rule out a trusting trust attack. Pnpm should be considered for hob
802.
by lrvick 1y ago
Package signing of any kind was ruled out in 2013 for nonsensical reasons https://github.com/npm/npm/pull/4016
803.
by lrvick 1y ago
The most important is just having authors sign their code and packages, and verifying code that is signed on download, like every sane Linux distro goes. Except NPM rejected this over and over going back to 2013. https://github.c
804.
by lrvick 1y ago
Hardly. I run a b2b tech company in silicon valley, frequently travel the world, and have a fairly active social life. No essential services ever -require- a phone. Just say it is against your unspecified religion and watch them fall over b
805.
by lrvick 1y ago
First thing I did to beat my addiction was keep my phone in airplane mode at all times, and just rely on wifi. After porting my number to a voip provider, i just canceled my cell phone subscription and then the device was no longer a phone,
806.
by lrvick 1y ago
Literally lock it in a safe for a month and see if after you recalibrate, if you are happier. Not carried a phone in 5 years and one of the best choices I ever made. Nothing you want to do in life requires you owning a phone if you are reso
807.
by lrvick 1y ago
bring a mechanical puzzle, or a book to read, or a lock to pick, or a tiny pocketable laptop that allows you to actually be productive, and leave the brainrot device at home, or get rid of it. 5 years free of doom scrolling and never been h
808.
by lrvick 1y ago
In my household no one has cell phones, so we set expectations of checking in once a day via chat over wifi from laptops, radio, meshtastic, or picking up a public phone... and otherwise learn to be resourceful, self confident, and independ
809.
by lrvick 1y ago
100% which is why I refused to even try to be a parent until I gave up my smartphone. Parents unable to be present with their kids, should not be parents.
810.
by lrvick 1y ago
I am all for phone bans in schools, but if the alternative is forcing them to use googleshit, and agree to googleshit terms of service, also hard pass. I would insist any kid of mine be allowed to use open source tools that can be studied a

More ›