mmarian

9 ms·

271.
by mmarian 6mo ago
Yes, it's maddening. Especially since it's a fair amount of effort to move to commit SHA pinning and establish a good maintenance/monitoring process around it; if I knew it would be adopted quickly, I could argue that people
272.
by mmarian 6mo ago
Few, if any. Which is why I'm highlighting that you can't just use commit SHA + Renovate then call it a day.
273.
by mmarian 6mo ago
How would that solve the problem though? You're still bringing compromises in, just with a delay. And the fixes will come in after the compromise, in accordance with the delay policy. To make matters worse, you'd lose getting aler
274.
by mmarian 6mo ago
Oh, nice, will look into it, thanks! Let me know if you're aware of any other tools that do this. I had a look before and couldn't find any.
275.
by mmarian 6mo ago
I mention in the posts the problem with the likes of Renovate. Auto merging is equivalent to semantic versioning. You have to properly vet the influx of updates, and that unfortunately won't work in practice.
276.
by mmarian 6mo ago
I agree, silly limitation. On zizmor, there's no mention of coverage on commit SHA the section you've linked, nor in the entire page when I do Ctrl+F. Is there anything I'm missing?
277.
by mmarian 6mo ago
I used to think whitelist could be a partial solution. But after Checkmarx KICS got compromised I can't see this working. I would've considered a well-established brand, in security industry of all places, to be in the whitelist.
278.
by mmarian 6mo ago
Agreed. Good news is GitHub will address that with Immutable Releases https://github.blog/news-insights/product-news/whats-coming-... You won't even need to use commit SHA as long as the maintainer follows th
279.
by mmarian 6mo ago
If you auto merge those PRs you're back to square 1 as you're not vetting your dependency updates. And if you don't, you incur operational overhead unless you put in a fair amount of effort centralizing. Wrote a couple of pos
280.
by mmarian 6mo ago
There are downsides to it though. You... - lose vulnerability alerts - increase maintenance overhead - take on all that for value that will go to 0 once Immutable Releases gets widely adopted I wrote a couple of blog posts on it, and a make
281.
by mmarian 6mo ago
I do that too. Wouldn't say it's relying on the logic. It's more hearing another perspective. Sometimes I think what it's saying makes sense, sometimes I don't.
282.
by mmarian 6mo ago
Yep, I've done that a few times, eg https://developerwithacat.com/blog/052025/postmortem-company... Quite cathartic. And I occasionally share it in some conversations to avoid repeating the story.
283.
Cost of smoking in England up 25% to and£21.8B (2024)(ash.org.uk)
1 points by mmarian 6mo ago|0 comments
284.
by mmarian 6mo ago
Just Googled "cost of smokers in UK", and first result I got - total annual economic cost of £46B, for England alone https://ash.org.uk/media-centre/news/press-releases/latest-f...
285.
by mmarian 6mo ago
Just let the taxpayer funded healthcare system deal with the burden. See how you can go the other way too if you want to be objective :)
286.
by mmarian 6mo ago
Meetups tend to have huge backlogs for speakers. Tried it in a couple and they said 8 months at least.
287.
by mmarian 6mo ago
Review the methodology, if you can, and form your own conclusions. Don't bother trying to change people's minds. It rarely works, and often causes conflict, even in the case of people who say they're data-driven.
288.
A free solution to the GitHub Actions supply chain crisis(developerwithacat.com)
2 points by mmarian 6mo ago|0 comments
289.
by mmarian 6mo ago
Democratization of software through SaaS & new engineers brought Airtable, Smartsheet, Baserow, Monday, and many more that I can't remember though.
290.
by mmarian 6mo ago
My personal use case is a replacement for pandas for ad hoc analysis in Jupyter notebooks, which I have to do very often these days. If I had to store the data I'd pick S3+Glue+Athena.
291.
by mmarian 6mo ago
With my enterprise hat on, I'd say Athena + S3 is good enough. Only use DuckDB for ad hoc analysis.
292.
by mmarian 6mo ago
Probably because you probably don't have to do those arbitrary transformations that often. I do, being in a security-related role. But I wouldn't have recognized its usefulness in my previous roles as a front/backend dev.
293.
by mmarian 6mo ago
Yep. And easy to reuse as well since it's just SQL.
294.
by mmarian 6mo ago
It's been a lifesaver for some analysis I had to do on 70GB of Cloudflare logs.
295.
War disruption forces biggest condom maker to raise prices by up to 30%(ft.com)
3 points by mmarian 6mo ago|0 comments
296.
by mmarian 6mo ago
Oh, thanks, didn't look at the feed before submitting. It's a dupe indeed.
297.
Show HN: LibreThinker, free AI assistant for LibreOffice Writer, 10k installs(librethinker.com)
2 points by mmarian 6mo ago|0 comments
298.
Meta to track workers' clicks and keystrokes to train AI(bbc.co.uk)
2 points by mmarian 6mo ago|2 comments
299.
2× – nine months later: We did it (Intercom)(ideas.fin.ai)
1 points by mmarian 6mo ago|0 comments
300.
Phones to be banned in schools by law in England under government plans(bbc.co.uk)
2 points by mmarian 6mo ago|0 comments

More ›