marcc

Adding images involves us creating a new package (APK) in our APK repo. This is done by creating a melange build config (https://github.com/chainguard-dev/melange). The melange config defines some basic tests. It's not comprehensive, but generally validates that the binary produced is functional.

When we build the OCI image, we validate it via some custom tests that we've written. We have identified the canonical image (i.e. DockerHub, GHCR, etc), and we confirm that our image has the same entrypoint, args, env that the canonical image has. Then we have some generated scenarios we run the OCI image through to make sure it functions the same as the canonical image runs.

For example, we have Postgres in the catalog today. When we rebuild, we have some tests that run with various configurations of PG_DATABASE/PG_PASSWORD, etc env vars. We run these with our image and with index.docker.io/library/postgres, and expect to see the same output with both.

We often deliver in way less than 6 days but sometimes the dependency tree is deep for a patch.

I've seen most auditors mandate 30 days for Critical, but you clearly want to move a lot quicker than that.

We work together on it. Assuming you have a build process and dockerfile (we all do), generally our team can get you listed in the catalog quickly.

It's not too much work since we built on an existing set of tools (melange & apko). I've actually found that putting a Dockerfile into ChatGPT generates a really good first iteration.

Plenty of responses here: https://www.reddit.com/r/teslamotors/comments/p59vwc/eli5_wh...

Exactly this. Art changes over time. The mediums that we use to express ourselves creatively evolves. The position that AI is the end of creative art isn't taking this evolution into account.

When video became an affordable medium, would people say "this is the end of art, live performances are art. Now the people will just watch the same recordings over and over?" Maybe, if the internet existed. But it's had the effect of creating and introducing new art forms.

AI generated content won't replace art. It will evolve it to a new creative.

I've used https://www.hnreplies.com/ for years here. Agreed that this is something that would be great to have built in.

> security teams is for when things does not go as expected.

That's an unexpected view. Security teams are experts in security and help application developers think of ways the product could be exploited. Security teams run pen tests and bug bounty programs. Security teams manage compliance.

Separation of duties is a critical part of building a secure system, and you can't have separation of duties properly if app developers do it all.

Don't think of a security team a punishment for when things didn't go as expected, but a good security team can help increase velocity and confidence and security all at the same time.

The outages this week have been rough. But outages can and will happen in any provider. I think the better goal is to find a way to use upstream providers in a more resilient way. When they are down, can you have fallbacks to another provider, or will that be too much engineering effort? Don't look for a provider that will be up 100% of the time, but figure out how to make sure your service isn't down when Cloudflare is down.

Yikes. If still true, this feels like a significant single point of failure in their architecture.

> It’s actually a vendor-agnostic replacement for the client side of DataDog, New Relic, or Azure App Insights.

The client side of DataDog, New Relic aren't nearly as complicated as Otel.

Type a prompt and then get asked to log in. I see this as a dark pattern because if I don't want to log in, I've put data and time into your site and not getting results. If you want to keep this workflow, I'd suggest maybe letting people try it once without logging in?

Curious if you measure this and how much drop off there is between fill out a valid prompt and not logging in to see the results.

Got a link? I'm not sure how this would even work, but if you aren't kidding, I'm curious to read the marketing.

The "AI Not Welcome Here" is interesting at the bottom of the Readme.

https://github.com/MrIceman/go-uml#warning---ai-not-welcome-...

This is a pretty hard stance to take when creating an OSS project. The author made an open source, MIT-licensed repo. Right now, the statement reads "I wrote this all myself". Does that mean the author is not willing to accept PRs?

Or will we see something like a DCO that developers make an attestation that AI was not used in creating the change?

Why not? I’m curious to understand this phenomenon. You see value it copilot, presumably because it makes you more efficient or productive. But either not enough to pay the fee, or.. ? Mind sharing why you aren’t willing to pay? (I don’t work for GitHub. I do write commercial software though)

How big is the organization that has this requirement?

This is pretty cool, just tried it out. I wish I could give it a little more than "keywords". Give me a textarea to explain the website and (maybe a different) for me to specify some design constraints or considerations.

In the end, it built a simple website, but just wasn't "ready to launch". What are the plans to make this more customizable?

Interesting. I hadn’t thought about this as a pure money grab yet.

What do they expect to happen if they win? OpenAI can't use GPT-4 (or build/release GPT-5), but the innovation will continue in areas of the world not subject to this regular?

I understand that the LLM models are advancing quickly and aren't easily explainable or transparent. The models feel like magic at times. But that doesn't mean society should shut them down.

This is fearful behavior and spreading FUD really. These folks should take the time to understand how an LLM works before taking this action.

SAML shouldn't be too hard if you use a library or a service such as Auth0. What problems did you have that made it so difficult?

What do you mean by "pop"? I can't tell if you mean that the valuation could increase significantly or pop like a bubble and decrease.

While there are solutions here, generally an app needs to have the actual database password or the ability to create one. A bcrypt of the password just won’t let the gitea server connect.

Are you advocating that everyone can log into the root account? Or maybe I’m not completely understanding here.

No notice in the US yet…

Thanks for the kubelist podcast mention. It’s fun to record these and happy to hear you enjoy it!

I agree that "the complexity of Kubernetes is overstated". Kubernetes itself is actually pretty simple, very reliable, and more mature than it seems. The complexity and challenges of Kubernetes come from all of the add-ons that may not be necessary in most situations.

Vanilla K8s is pretty good. But when you think about admission controllers, policy engines, service meshes, progressive rollout, etc, you are increasing the scope.

Start with k8s, and hold back the temptation to solve 10 other problems with 10 other projects from the CNCF sandbox. Once you have a good system running, really evaluate the complexity of each new solution with value it provides, and make a decision. Say no to most.

Sarcasm? I think most people should care about this.

I’m the creator of https://schemahero.io, another utility that does something similar. I love seeing innovation in this space and congrats on building this. Atlas looks really cool, I’m going to check it out.

Maybe we can chat about the challenges of building automated database schema migrations sometime!

Why are we reading this on the SEC site and not the GoDaddy site? I did a quick search and can't find a disclosure on their site. If it's there, it's not easy to find.

Security incidents are going to happen. This particular incident looks to be avoidable (static passwords!). What we should judge the company on is their response and transparency. GoDaddy disclosed, but a new customer on the site wouldn't find this. They also used phrases like "affects our Legacy WordPress Platform" probably to attempt to shift a little blame from the current team or minimize the fall out.

When you have a security incident, be transparent, own it, and deal with it. We can tell when you are trying to sweep it under the rug and hide, and that's bad. This is an opportunity for an org to show that they put customers first and shine.