Audun Mo (he/him)

Operator overloading is one of those "they were so concerned with whether or not they could, they never thought about if they should" situations

I learned about Docker ONBUILD the other day. You can sneak build instructions into downstream image builds. I think this is really scary, and it seems to be not very well understood I wrote about how it can be dangerous, and how to defend against those attacks www.o3c.no/knowledge/un...

So github response to the recent TeamPCP hacks is good. I wonder if threat actors will be moving to compromise OCI images instead, as the mutability of tags in Docker presents a similar vulnerability as the mutable tags in git releases do

So like what are the best atproto / atmosphere apps? I'm aware of tangled, but that's about it

After configuring my @tangled.org knot, I've gotten kind of obsessed with the idea of self-hosting the entirety of my dev workflow. Next I'll be self-hosting a image registry I reckon, just for the hell of it. Imagine being free of the big-tech hegemonies in your hobbyprojects!

Is Github Actions down again?

I opened X to look at Elon Musk tweet. Do I hate myself? Why did I do that to myself?

What is h a p p e n i n g over at cloudflare. Down, again???

Damn, ECMAScript-like syntax and compiles to bash? Folks, I think I'm in love amber-lang.com

Manifesto:

Within sometime in the next five years, there will be a story of someone using an LLM like a GPS to navigate, and it will be hilarious

I have no earthly idea why the world landed on using SPDX over CycloneDX as its default. And I'm so sad about it

The fact that tags are immutable on docker hub by default blows my mind.

At what point do we just classify the entirety of npm as a vulnerability, and just be done with it? Js needs a better standard library, and packages that can't randomly RCE your build pipeline if they feel like it

If you sell products that purport to shift left, but don't support IaC or other code-based config, the product is not doing that. UIs and click-ops invite reactive, right-end operations, and it's often a sign of other legacy thinking / approaches in your tools

Pushing ads on a service, then making a subscription to not have ads, is not a feature. It's not a product. And if it's the best you can think of, your company produces nothing

Linkedins algorithm for what to create notifications for needs to be studied. I don't think I've seen an algo less able to find relevant information

Bad features cause security risks, like bad road layouts lead to accidents. Case in point, github notifications. Filtering out the noise is so hard that I find drawn to separate apps to handle them. I don't because of the risk, but the avalanche ushers me in their direction

A long time ago, I saw a thing about programmers on dating apps who make themselves out to be much more important than they are. "Calm down, Brad. You're making computers go beep boop correctly" is still one of my favorite take down of anyone online

I thought to myself "the clock is just Thursday". In other words, my friend's 5 day bachelor party is going well

Note to anyone creating a scripting or rule or whatever language. Do not design your language so that comparison happens with =. Always assign with = and compare with ==. Otherwise all code produced in your language will be bad. And if = does both, you do not deserve good things in your life

It is 2025. Stop sending "hi" on slack. Just say the thing you want or need right away

I think "don't meet your heros" also applies to looking at your heros Twitter account

If it computes, someone has already installed doom on one

Contender for best feeling ever 🧹🧹🧹

Does anyone know how renovate or dependabot handles a git release tag being moved to a new commit for github actions when you've pinned your workflow to commits? Do they create new update PRs to reflect the new commit? Or do they stay on the existing pinned commit?

The compromise of GitHub Action tj-actions/changed-files has impacted only a small percentage of the 23,000 projects using it, with it estimated that only 218 repositories exposed secrets due to the supply chain attack.