cyrnel

6 ms·

1.
by cyrnel 11mo ago
The response to that: https://andre.arko.net/2025/10/09/the-rubygems-security-inci...
2.
by cyrnel 1y ago
Both are billion dollar companies, we as individuals have nothing in common with them. Enshittification happens due to market conditions that apply to small and large companies alike. Redis and elasticsearch aren't underdogs fighting f
3.
by cyrnel 1y ago
+1 for Node-RED. If we've learned anything from elasticsearch/redis/bitnami/and dozens of others, it should be "don't build important things on code that isn't enshittification-resistant"
4.
by cyrnel 1y ago
I know, right? It's sycophancy. If you are actually against the policy and suspect a lot of people are too, then don't silence your employees by keeping their feedback isolated to 1:1s which you admit are ineffective. Executives n
5.
by cyrnel 1y ago
Code signing, 2FA, and reducing dependencies are all incomplete solutions. What we need is fine-grained sandboxing, down to the function and type level. You will always be vulnerable as long as you're relying on fallible humans (even y
6.
by cyrnel 1y ago
It's true that we were all sold the lie of individual actions being the way to solve the climate crisis (recycling, turning off lights, etc.) But I think the conclusion is to try other strategies rather than giving up when the first st
7.
by cyrnel 1y ago
The ideal situation would be building a society that believes everyone deserves to be fed, clothed, and housed regardless of their ability to make profitable things. Weird how politically unpopular that seems to be. Both producers and consu
8.
Et tu, Panera?(scottsmitelli.com)
3 points by cyrnel 1y ago|0 comments
9.
by cyrnel 1y ago
This seems to only address a few of the nine threats to the software supply chain, mainly "(D) External build parameters" and maybe the content-addressable storage addresses some of the distribution phase threats: https:/&#x
10.
by cyrnel 1y ago
BNPL is only "good" if your definition of "good" is about GDP, market flexibility, high-performance index funds, and other things that have nothing to do with human happiness. I'll believe that BNPL is good when all
11.
by cyrnel 1y ago
People have been running different levels of privileged code together on the same machine ever since the invention of virtual machines. We have lots of lightweight sandboxing technologies that could be used when invoking a particular action
12.
by cyrnel 1y ago
Every action gets these permissions by default. The reason we know it had that permission is that the exploit code read from /proc/pid/mem to steal the secrets, which requires some permissions: https://blog.cloudfl
13.
by cyrnel 1y ago
This has some good advice, but I can't help but notice that none of this solves a core problem with the tj-actions/changed-files issue: The workflow had the CAP_SYS_PTRACE capability when it didn't need it, and it used that p
14.
by cyrnel 1y ago
Amazon really encourages valkey in the elasticache dashboard. There's a banner advertising lower prices and it's listed first in the dropdown when you go to create one. Default settings do have power.
15.
by cyrnel 1y ago
I think this article describes the issue well: https://crankysec.com/blog/community/ > All the cybersecurity companies saying "We don't have anything to say about this situation." is just them be
16.
by cyrnel 1y ago
On its own, immutability isn't a complete solution to supply chain attacks. Software still needs to be updated and those updates could contain malware too. You need immutability and something like sandboxing where actions cannot e.g. d
17.
by cyrnel 1y ago
I've seen this more formalized as a triangle, with "functionality" being the third point: https://blog.c3l-security.com/2019/06/balancing-functionalit... You can get secure and easy-to-use tools, bu
18.
by cyrnel 1y ago
The effort to replace US tech is not anything similar to the European tech industry. US technology has a hegemony because we were first to the party, our economy is larger, and our laws are hostile to newcomers (lack of interoperability req
19.
by cyrnel 1y ago
> you're going to personally be better off changing companies Job mobility for tech workers is a fluke of current economic conditions. If interest rates spike, or a recession happens, or a bubble bursts, this benefit would go away a
20.
by cyrnel 1y ago
There's no reason why tech unions can't have solidarity with other unionization efforts (and there are thousands of reason why we should have that solidarity). Us tech workers could be leveraging the privilege we have to get bette
21.
by cyrnel 2y ago
Thanks for the edit! In "incident response mode" every moment counts!
22.
by cyrnel 2y ago
The advertising in this article is making it actively difficult to figure out how to remediate this issue. The "recovery steps" section just says "start our 14 day free trial". The security industry tolerates self-promot
23.
by cyrnel 2y ago
I think declining an exit interview is bad advice for the exact same reason that venting during an exit interview is bad advice. Declining makes you look obstinate and can be used against you as well. You can just give neutral feedback (&qu
24.
by cyrnel 2y ago
No discussion of language loss is complete without mentioning the hundreds of indigenous languages that were eradicated by force: > "Funded by the federal government and contracted to religious missionaries, the purpose of a residen
25.
by cyrnel 2y ago
There's not a lot of "breaking down" happening here. It's the same vague recommendations that can be found in the NSA's own documents, further reinforcing the gap between the guidelines and practitioners. NSA/N
26.
by cyrnel 2y ago
The author's pronouns can be found here: https://github.com/Xe
27.
by cyrnel 2y ago
Seems some of these bots are behaving abusively on sites with lots of links (like git forges). I have some sites receiving 200 requests per day and some receiving 1 million requests per day from these AI bots, depending on the design of the
28.
by cyrnel 2y ago
You could replace "they do not care" with "they are prevented from caring" or "they care about different things" to get a more empathetic take. Designing entire cities on shoestring budgets and break-neck timel
29.
by cyrnel 2y ago
It's not hard to change to git switch. I used to have a "co" alias for "checkout" which I removed. I'd say I lost maybe 60 seconds of typing time over the few weeks it took to unlearn the muscle memory. 60 seco
30.
by cyrnel 2y ago
This seems to start from the strange assumption that companies have a clear and correct understanding of what things to prioritize, and then concludes that deprioritizing glue work is actually smart. Historically, companies really don'

More ›