News for hackers. Stuff that matters.
Re:Open Source Security at Astral by saghm on Thursday April 09, 2026 @06:27AM (#47701759)
> Why is it a bunch of mostly unpaid volunteer hackers are putting more effort into supply chain security than OpenAI.

Didn't the acquisition only happen a few weeks ago? Wouldn't it be more alarming if OpenAI had gone in and forced them to change their build process? Unless you're claiming that the article is lying about this being a description of what they've already been doing for a while (which seems a bit outlandish without more evidence), it's not clear to me why you're attributing this process to the parent company.

Don't get me wrong; there's plenty you can criticize OpenAI over, and I'm not taking a stance on your technical claims, but it seems somewhat disingenuous to phrase it like this.

Re:Open Source Security at Astral by woodruffw on Thursday April 09, 2026 @10:44AM (#47704442)
Yeah, I'll just establish for the record that we've been thinking about this for a long time, and that it has nothing to do with anybody except our own interests in keeping our development and release processes secure.
Re:Open Source Security at Astral by saghm on Thursday April 09, 2026 @11:21AM (#47704921)
That fits what I had assumed (and would expect), but it definitely doesn't hurt to have that confirmed, so thank you!
Re:Open Source Security at Astral by lrvick on Thursday April 09, 2026 @05:04PM (#47710077)
I was just calling them by their new name, but yes clearly I am not the biggest fan of OpenAI and me invoking their name so soon betrays that. Sam altmans vision for handling the "proof of human" problem WoT solves is having everyone scan their eyes into magic orbs you can't audit at runtime and letting them sign stuff for us. Cool. I will take WoT over that every time.
Re:Open Source Security at Astral by saghm on Friday April 10, 2026 @03:34PM (#47722651)
> I was just calling them by their new name, but yes clearly I am not the biggest fan of OpenAI and me invoking their name so soon betrays that.

My point is that at least from the standpoint of "Why does this process exist in the way it does?", OpenAI is not their "new name" in any logical sense. If you aren't happy with the process used a year from now, it would be reasonable in my opinion to criticize OpenAI for not making it different somehow. I'd argue that a parent company trying to make substantive process changes in such a short window would be strictly a bad thing though, because it would mean they didn't take the time to fully understand the context of what it's trying to solve and why it's the way it is currently.

I don't really disagree with anything else you're saying about OpenAI here, but I still think it's somewhat disingenuous to name-check them in this context.