lrvick

13 ms·

241.
by lrvick 2mo ago
You can sideload (for now) but that forces you to enable "unknown sources" and increase the attack surface on your device, forcing you to reproduce every new release from source by hand to verify it was not compromised... or blind
242.
by lrvick 2mo ago
Zuck built an empire to sell democracy to the highest bidder and to damage the mental health of children to suicidal levels, for money. We must never let anyone forget that for a second. That said, he is also a powerful enemy of our enemies
243.
by lrvick 2mo ago
It has to be 100% open source public code or we will have no way of proving this is not malware, or secretly swapped out for malware later when your CI/CD system or laptop is compromised. Supply chain attacks happen all the time and wi
244.
by lrvick 2mo ago
I was kind of excited for this until the binary blob. You want me to give your agent binary god access to my computer, and I am not even permitted to see the source code or use my own supply chain security hardened rust compiler stack? What
245.
by lrvick 2mo ago
This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via a
246.
by lrvick 2mo ago
I struggled to find a decent job that would let me build FOSS to the depth and quality level I want. But when the job you want does not exist, then sometimes the answer is creating that job. I started a FOSS linux distro, stagex, and co-fou
247.
by lrvick 2mo ago
When I said I advise friends to stop depending on corpotech, I am not telling them to quit their jobs unless they are independently wealthy. I am telling them to quit also using or relying on corpotech in their personal lives, favoring inst
248.
by lrvick 2mo ago
Every single new innovation in technology wipes out giant swaths of jobs. The invention of the loom, the printing press, the refrigerator, the radio, automobiles, the internet... etc etc. Technological progress is not evil, and those of us
249.
by lrvick 2mo ago
Fair feedback. Not inventing our own language has drawbacks, but we are convinced the security and portability wins of sticking to standards with many existing implementations, however awkward at times, are worth it. No major OCI runtime su
250.
by lrvick 2mo ago
Thats just all stuff one puts in a containerfile that generates their disk image. We can build any disk image nix can though with different syntax.
251.
by lrvick 2mo ago
https://git.distrust.co/public/airgap/src/branch/main/Contai... That containerfile defines an entire deterministic custom OS image, every package, and every configuration etc. Many patterns are poss
252.
by lrvick 2mo ago
there are several distros built using stagex to get a disk image like airgapos. Just a containerfile a user writes at the last mile. But when my current "distros" branch lands ideally this month, we will have in-tree support for b
253.
by lrvick 2mo ago
Both statements are valid for StageX
254.
by lrvick 2mo ago
You can define an immutable, deterministic, and bootable system image for anything from an enclave to a laptop with just the primitives provided by the OCI Containerfile standard. A stagex containerfile can define a system build recipe in s
255.
by lrvick 2mo ago
https://stagex.tools
256.
by lrvick 2mo ago
Anyone looking for a full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix, check out https://stagex.tools https://codeberg.org/stagex/stagex
257.
by lrvick 2mo ago
Imagine an evil version of this person: https://en.wikipedia.org/wiki/Jo_Zayner
258.
by lrvick 2mo ago
I am finally able to deliver on years of backlog ideas thanks to the GPUs I racked up in my garage. Having a blast. Everyone I know fully dependent on corpotch seems pretty sad though. I frequently suggest that they stop. It has not worked.
259.
by lrvick 2mo ago
So they will not be accepting most security patches. Fun.
260.
by lrvick 2mo ago
I say this as a fan of a lot of what Framework is doing. Lets not pretend we do not all -know- virtually every SaaS sucks ass at security because it slows down sales. Companies that use these easy button services anyway are knowingly puttin
261.
by lrvick 2mo ago
I would note that we already have groups of hobbyists in the bay area using CRISPr kits to genetically alter frogs, dogs, and in some cases human DNA at home, and even making MNRNA vaccines at home or community labs. I think underestimating
262.
by lrvick 2mo ago
I am going to be PRing herdr to stagex as it is my daily driver. This will give it a totally independent release process with multiple parties bootstrapping, reproducing, and signing deterministic binaries for it alongside our tmux releases
263.
by lrvick 2mo ago
It is not one angry person shutting down the internet or a massive supply chain attack that worries most as a security researcher. I have come to accept such things are way too easy, and therefore likely, but as a species we will survive wi
264.
by lrvick 2mo ago
While we are building for a dramatically different threat model, we use quite a few of their llvm patches and are very thankful for their work, and alpine making llvm/musl a viable option for us.
265.
by lrvick 2mo ago
We use musl+mimalloc by default for our entire production operating systems: https://stagex.tools
266.
by lrvick 3mo ago
Which is why automated signatures in release pipelines are usually meaningless. Authors must sign their code on their own hardware before it is published so we can tell when the signing key changes and pay extra special attention to that, a
267.
by lrvick 3mo ago
If an author is not willing to do responsible release engineering they should lose their publishing ability and have their project marked as unmaintained. This would force people to migrate to better maintained code, or find responsible vol
268.
by lrvick 3mo ago
Refusing security patches and bug fixes because an engineer chose to use an auto-complete engine you do not like is categorically negligent. Might as well mandate everyone use a special editor too. Probably emacs. I know a kernel developer
269.
by lrvick 3mo ago
Well, they should point users to a project responsible enough to accept huuman reviewed security and bug fixes that happen to have been written by an llm.
270.
by lrvick 3mo ago
I paid $8 for the recently expired email domain of the sole author of NPM package "foreach", so then control to ship any code I wanted to 70k companies was just a support ticket or password reset away. 72 hours would not make a di

More ›