I think we are at the point where everyone really needs to run each project in its own vm.

Given the recent lpe vulns docker 100% won’t cut it.

And containers were never meant primarily as a security boundary anyways

QubesOS had the right idea. You want layers and layers of security, with multiple VMs at the root.

See also: https://genode.org/

Also, in addition to isolation and https://en.wikipedia.org/wiki/Capability-based_security between processes, capability security within processes, see languages like E (https://web.archive.org/web/20260506035108/https://erights.o...) or Monte (https://monte.readthedocs.io/en/latest/index.html)

I mean that in the sense that they had the idea way before the wave of rapid linux 0days and supply chain attacks were common. The design they picked has only become more relevant.

Luckily, projects using more secure language ecosystems like C and C++ are spared this kind of problems :-)

No, instead the code that isn't from a dependency is what will cause you to get pwned

I think you missed the joke/sarcasm there.

It's been less than a month since I responded to a comment on a different thread arguing basically the same thing about C/C++ in a serious way. I've long since lost the ability to distinguish.

Fair, I'm in fact not 100% sure it's a joke. But there's a smiley, that's pushing me to 90%.

The virus fest of the 90s would like a word with you and your C

you can't get infected through the package manager if your language doesn't have a package manager :) turns out C and C++ were playing 4D chess all along

Devcontainers (I know it's not a full VM, but it's most prominent version of this "isolated development environment" concept) wouldn't fully protect you against this. Github credentials are automatically pulled into the container. If you are using other cloud services that need to be accessed within the container, this cred stealer will grab their creds too.

It would limit the blast radius, which at least is an improvement.

This is one reason I have my own dev container script. And the container pulls nothing in except whatever I explicitly put in my .podman folder. It runs without any GitHub access at all. I do all of that from the host machine.

Or a vm per container, if you insist on containers. I've have a couple of relaxed weeks recently due to running everything on VMs rather than some random Kubernetes service.

it's not going to help if you share a cache across security boundaries. That is what happened here and seems to be driving a spate of github action related problems.

Well for one, so it doesn’t get recalled after getting a reputation for making people blind

Idk how git works under the hood but those both seem like they could both be easily accomplished with git itself .

but if not just your own work flow, have a dir dedicated to storing prompt history and then each file is titled with the commit id.

As for the flag just agree to some convention and toss it in the commit message

I’ve used bunny for a few years … happily. I wonder if this is a bug due to some meta data of the files like the names or something. Very weird. Good thing you had metrics to catch it.

I upload all object storage stuff to bunny for live but also to backblace for backup.

I’ve always wanted to implement fail over client side for any asset over to bacblaze but seems like a lot of overhead

You’re a great brother! Sorry to hear your unappreciated.

I have a friend, philosophy masters, smart, autistic and he is not entering the work force. Any tips?

No, I am not. That is the thing—it has been 7 years, and we are stuck in the same loop. If I were to give your friend advice, it is to send a lot of warm emails. Joining a freelance marketplace is going to be brutal. Connect with folks in different communities, talk with them a bit, and then ask if they have any jobs. The success rate I would say is about 1 out of 50 to 70 outreaches.

I watched a YouTube video the other day about how the usa tracks missle launches globally. I would assume they have to pass a minimum threshold of power/heat/energy to be detectable.

Let’s all pray this toy project, if readily upgradable, is also trackable and well … the way we keep law and order is by actual policing and prosecuting. So hopefully this doesn’t get out of hand.

Very impressive, but very troubling.

Right now, today, the US government and it's three letter agencies are being run by a club of human trafficking peodophiles and rapists. Not individual, isolated, crimes. An organized group of very twisted people, having 'immigrants' rounded up and killed, pushing women back into the 1920s, and trying to make anyone who strays from heteronormative a criminal.

Having some independent developers in the defence market is not necessarily a bad thing.

Isn't it obvious that, if one person can do it, many more can do it as well, and probably have? It's not like they'll put it on GitHub.

This thing doesn't do anything a launcher from the 70s couldn't do.

Global detection is for balistic missiles, not things launched by human portable devices

Gemini is so stubborn, and often doesn’t follow explicit and simple instructions. So annoying

I never got too far with prompt injection, but one thing I wonder is if you overload the llm, repeatedly over context, repeatedly over its context trimming tricks buffer … can it fail open?

Me and my buddies still use team speak. Anyone else?

Have you tried Mumble? That's what me and my buddies use. We've been playing Barony lately.