bavarianbob

This is so awesome. Kudos!

This is pretty cool, I'm doing something similar for binaries I use on my computer - https://github.com/chasen-bettinger/conf/blob/main/binaries....

I think this is a killer project that's very needed to accelerate the learning of how to defend against the deluge of nascent CI/CD risks. Kudos Boost team!

Do you have a working example of a skill reducing tokens on repeat tasks? I'm personally seeing the cost of writing and maintaining skills to be much larger than the tokens I'm saving by doing so.

I think an engineer might, but my mother and wife will certainly pick the $5/mo option every time.

I thought similarly to you, until I saw it: https://www.youtube.com/watch?v=abRie4vAvJ4

I've worked in software supply chain security for two years now and this is an extremely optimistic take. Nearly all organizations are not even remotely close to this level of responsiveness.

Post your resume

This is explained here:

> Here's the trick: github.actor does not always refer to the actual creator of the Pull Request. It's the user who caused the latest event that triggered the workflow.

Sorry, what?

Hard for me to believe that even with a surplus of domestic production that comparative advantage of importing still wouldn't be better.

Surprisingly, in this context, I frequently came across interfaces that make it difficult to implement certain features using those libraries. There's not a one-size-fits-all implementation yet.

I think you're going to scarcely find a company that has a direct open source -> hire pipeline. However, one of the most valuable parts of contributing to open source that I have personally found is forming connections and having those connections referring you to companies. I encourage you to find a company + project combination that you enjoy, find ways to collaborate, and make relationships. Doing that will likely yield huge dividends.

Awesome project!

As someone deeply familiar with this problem (ex-JupiterOne), I'd caution against asserting that 'deep level of customization' is a differentiator. Your buyer (CISO) and userbase (Sec Engs) are drowning. They (and I) don't want yet another product to build on top of. This is a key reason why Wiz is so successful -- an operator can turn Wiz on and immediately receive value, no adjustments or additions needed.

I'd strategically focus on making the 'actionability' part the cornerstone of the product and really become obsessed with making that part of your product incredible. The Goliath-killing story you need will be formed by figuring out how to get your product to the point where someone can turn it on and immediately receive value for the most impactful security problems first (ex: Log4J) and the total surface area of problems the product solves for second.

It's another requirement to comply with. More work for the producer == higher cost for the consumer.

Do you have any comments on how to best absorb Ficciones? I read it recently and struggled through the whole book, needless to say, I don't comprehend why many hold that book on such a high pedestal.

I interpreted the parent to mean that it might not be fair to assume existing package managers have done a _great_ job at downloading and verifying, especially verifying, resources from the network. There are businesses that exist attempting to solve this problem like socket.io. Safely installing the correct dependencies for a project is still not a guarantee from any of the major package managers.

Oh my amen.

Have a link?

Do you think an environment like this in say, VR, has merit?

Is it necessary to specify TCP/IP? Is it not also applicable to books? Reading piles of pulp fiction is subtly different than language-flavored entertainment.

Curious to know if you believe it is truly lost because I would argue that what could be considered lost (artisan, soulful goods) still exists. Perhaps I also misunderstand "what" you believe is to be lost.

The problem lies in the perceived benefit that the user believes. The app, through its marketing and content, leads you to believe that you can and in fact, will, learn the language of your choosing.

Anecdotally, this has not been the case for me.

Similar to the parent, I have accelerated my learning tenfold by ditching D**** in favor of reading, watching, and listening to content in my target language as well as speaking to a tutor I found online.

I've wasted a tremendous amount of time going through and ultimately completing a tree only to find myself crossing the finish line not being comfortable saying anything in that language. Is that a criticism of me? Perhaps. But, the big D once fooled me into thinking the answer to that question was that it is. Which is to say, I don't believe it's a criticism of me.

It being a pacifier and it enabling some (read: non-zero) understanding of a language are not mutually exclusive. You exemplified my thesis.

How tf do you use LanguageReactor? That app is garbage, my lord.

this is badass

but worse!

"Your father isn't trying"

fucking lol, the audacity