lrvick

40 ms·

811.
by lrvick 1y ago
supply chain security focused linux distro that does not trust its own maintainers by design.
812.
by lrvick 1y ago
Job one is have every bit of software involved also be deterministic, which stagex takes care of. I had no problem getting deterministic LLM outputs when I experimented with this 6 months ago. Run two of these with the same prompts and same
813.
by lrvick 1y ago
Fair. I should have expanded. If everyone signed commits with well published keys, -and- if NPM would stop rejecting every PR and feature request for clients to verify signatures from authors that opt in, this problem would not exist for pa
814.
by lrvick 1y ago
Daily reminder that no one can easily impersonate you if you sign your commits and make it easy to discover and verify your authentic key with keyoxide or similar.
815.
by lrvick 1y ago
If your cell phone is connected to cell towers, almost anyone can buy your location. Only option is stay in airplane mode and use wifi.
816.
by lrvick 1y ago
We open source every line of code we legally can at Distrust, and it has paid off in getting us work, even on forks, many many times. Source code is cheaper than ever, so if you fail to open source first then an open source clone will be cr
817.
by lrvick 1y ago
Just say you do not have a compatible device. Special undocumented alternatives appear every time in my experience.
818.
by lrvick 1y ago
Nothing for the use cases I have in production other than more platform support, but those can be compile time features for when using those specific environments. I want 0 lines of dead code in production for easy auditing. https:/&#
819.
by lrvick 1y ago
Most of my early career was about writing a lot of code. Now 20 years later I pride myself in removing more code than I add to most repos. As a security engineer code is not just debt, it is risk. Especially dependencies. Recently a colleag
820.
by lrvick 1y ago
ssh socks proxy over port 443 should work in most situations
821.
by lrvick 1y ago
They absolutely did, and beat us to it. They were a fantastic reference, and we link to their blog posts in our readme. We even have a comparison with Guix there too. https://codeberg.org/stagex/stagex/#comparison
822.
by lrvick 1y ago
Meanwhile if anyone wants images with dramatically higher supply chain security than anything Bitnami ever offered, and free to the public forever, check out stagex. https://stagex.tools As the only multisigned, full source boot
823.
by lrvick 1y ago
The whitelist is the package-lock.json of the hashes of libraries you or a security reviewer you trust has reviewed.
824.
by lrvick 1y ago
If you install the app then you are complicit in normalizing the requirement of signing terms of service and data sharing agreements to US technology companies in order to do banking. Feel free to say you are a member of the Church of Crypt
825.
by lrvick 1y ago
The point in resisting it is to waste their valuable time on whatever the worst appless methods are, so they are forced to improve the efficiency to keep profits high if enough people do it. If you install the app then you are complicit in
826.
by lrvick 1y ago
Reminder that just because you got code from an internet rando making a new release, instead of from a peer, does not mean you get to skip code review. It blows my mind that any companies allow copying newly published code off the internet
827.
by lrvick 1y ago
Downloading binaries as part of an installation of a scripting language library should always be assumed to be malicious. Everything must be provided as source code and any compilation must happen locally.
828.
by lrvick 1y ago
I have never heard of a bank that has a hard requirement of a mobile app. Certainly none of the major banks like Wells Fargo or Chase require one. I do not own a phone and managers at times have to come up with undocumented fallback method
829.
by lrvick 1y ago
If it is decentralized then a ban in a US state would have no impact. Did not know about blacksky though. That is at least -some- progress.
830.
by lrvick 1y ago
Reminder that Bluesky is not decentralized, and can be censored or bought out just like Twitter.
831.
by lrvick 1y ago
Of note, it also will handle platform specific bring-up system calls, basic filesystem setup, etc, so it is much more suitable for embedded, server, or enclave use cases than tini, imo. It is mostly used for Nitro enclaves today.
832.
by lrvick 1y ago
Yep. The less C code in production the better.
833.
by lrvick 1y ago
Source? Maybe we can convince them to ramp up production with a crowdfund or something :D
834.
by lrvick 1y ago
Yeah we only recently broke it out as a standalone repo/binary, as everyone historically vendored it, so docs will get love soon, but it will be part of the next stagex release built and signed by multiple parties deterministically as
835.
by lrvick 1y ago
I use tiny init systems regularly in AWS Nitro Enclaves. Having the enclave and init system both named nitro is not ideal.
836.
by lrvick 1y ago
At Distrust, we wrote a dead simple init system in rust that is used by a few clients in production with security critical enclave use cases. <500 lines and uses only the rust standard library to make auditing easy. https://gi
837.
by lrvick 1y ago
Yes to all of that, but also glitch art unique to each tube which is an art style you can not readily create any other way.
838.
by lrvick 1y ago
CRTs are literally particle accelerators smashing electrons into phosphors with high enough accuracy to make human recognizable images. And this was not just at some university science lab. We mass produced this crazy shit and put it in mos
839.
by lrvick 1y ago
I have in the past used solutions like these to move elderly people to Linux that cannot emotionally handle a change in icons or where they exist on screen, and would never research technical problems on their own. Generally a bad call for
840.
by lrvick 1y ago
I would also note that I have never once heard of enforcement on using encryption but we -have- seen enforcement of using too much transmit power without a license. So if you like, get a license, crank transmit power, then use encryption al

More ›