I wouldn’t do any of that in a CI-only system. If I did, I’d use tools that exist for those jobs that already allow scripting languages.

1. Why wouldn’t you use IaC tools for this? All the majors have Python already.
2. What build or deploy task needs to both create and reference a bug ticket?
3. What build or deploy task needs to do database lookups? Or possibly what task needs those across multiple, independent stages?

This is a boilerplate example. I asked for something more than boilerplate. Give me some reasons why I need an incredibly stateful CI engine.

Looking at the examples, you’ve just made a brand new GitHub Actions framework. There’s YAML to wrap everything together and a bunch of Python that’s so declarative it might as well be HCL. Do you have an example that’s a bit more than “do what YAML does only in bash?”

I think the actually infuriating thing here is that subs like r/interestingasfuck were made because r/mildlyinteresting basically turned into “look at this thing I saw” without any critical evaluation. Those subs soon fell prey to the same shit. Unsurprisingly, it’s now infected the Lemmy communities too. “I saw this thing once” isn’t fucking mildly interesting. It’s fucking annoying.

In this instance I genuinely do not understand how photos of massive construction make anyone go “huh, that’s kinda interesting but not super interesting what a novelty.” If I’m super fucking gracious and OP has never ever seen satellite photos before or even considered the concept that could be slightly novel but that’s a fucking stretch.

Your second check is exactly why someone would check if it’s AI-generated.

I check whether it is safe to install. Are there security or privacy concerns?

Let’s review some basic security: the CIA triad stands for Confidentiality, Integrity, and Availability. Confidentiality is never a guarantee with AI-generated systems because the developers are usually spending even less time thinking about the code than normal since AI does the thinking. Plus AI systems are getting owned left and right (litellm anyone?). Integrity is never a guarantee because the developers don’t understand the system the AI slopped together and AI is only good at unit tests in some cases, not integration or end-to-end. That requires a system perspective. Finally, availability is usually worse with AI slop because AI is trained on really bad software that is rarely optimized. That requires vertical scaling out of the box.

Looking at this codebase, the integration cover hits three services and not totally at that. There are no security tests. There are no published security findings. There are no security standards in the contribution guidelines. While there is a disclosure process, there are no automated baseline tests available.

So why exactly did you move beyond your second check? This project has no security. Remember, that’s your guideline even before constructive criticism.

Edit: I just realized you’re the maintainer and you’re yelling at someone for asking about AI stuff when you can’t be bothered to do basic security. Worse yet, you’ve attempted to hide your slop instead of making users aware of the extra security issues. You have to understand I wouldn’t have commented on this if you hadn’t included a basic check you went out of your way to screw up. Glass houses and all that.

The pyproject.toml spec is ten years old. Python 3 is almost twenty years old. The community standard moved within the last five years. Tox is only necessary if you want to validate across specific versions so it can be replaced by tools like Poetry. If you’ve got GitHub workflows that’s the standard anyway so you should be running something like act locally. Static typing redundancy is a waste of compute.

If you’re going to be an asshole, make sure you can back everything up. You can’t so I’d recommend taking a breath and going outside.

Edit: I looked through your GitHub and even though your profile name is “msftcangoblowm” you don’t seem to use .yaml but instead the YAML extension Windows devs use.

The only guaranteed fix is in the kernel. You’ll want to check your distro for the CVE. The disclosers very happily bring up all the distros affected but do not seem to have reached out to any of them to also patch. The CVE itself is still waiting for NVD analysis beyond its base score.

I’m not actively saying they did anything wrong but I am saying they’re blowing smoke about responsible disclosure.

I think you’re displaying a very big gap between understanding risk assessment and understanding task completion. So far I have not seen anyone say they would not complete the task. I have seen people complete risk assessment. Risk assessment does not mean I will not do something, it just reflects the urgency with which I will do it. Most self-hosted users can safely apply basic risk assessment to see, while the impact may be high, the likelihood is low. Obviously the likelihood increases the more hands off you are with, say, unattended container updates for things that can escape containers or access the underlying system. Should most self-hosted users literally drop everything, rush home, and apply the patch? No, basic risk assessment does not merit that. Should everyone apply the patch? Yes.

Your comment said Forgejo has a disclosure process. The article says the author went with a carrot disclosure after reading the disclosure process and making a value judgement. Because your comment only mentioned Forgejo having a disclosure process, not an evaluation of the author’s evaluation of the disclosure process, it made you appear as if you had not read the article.

In your response to me calling that out, you offer an analysis. The author is lazy for using carrot disclosure over the defined disclosure process. That’s a valid take. I’m not going to disagree with that.

I don’t think you read the article.

Doesn’t Ubuntu still ship with Snap? I don’t think Flatpak trumps that yet. It’s hard to say one of the other formats won when Canonical (or Fedora derivatives in the case of Flatpak) still mainline something else.

Yeah fuck the bill’s sponsor and her desire to reduce costs for a family of four by $50 every month

State Sen. Mary Elizabeth Coleman, an Arnold Republican, said the bill is an attempt to increase affordability for Missourians as prices rise.

“Missourians are paying more and more for necessities,” Coleman said. “Most of us agree fundamentally that essential services should not be funded on the backs of the poor.”

Coleman said a family of four would save $54 per month with the removal of grocery sales tax.

Lumo isn’t really private. If you’re not local, you’re not private. AFAIK it sends to the model in cleartext (zero access) which isn’t E2EE. Signal, for example, is E2EE. Based on internet reviews, you’re better off running the models they offer locally for performance reasons on the cost anyway. I’d say you’re better off without AI in almost every situation you’d want to use an LLM of such such limited capability too so unless you really really want to set resources on fire it’s better to just drop it period.

Netflix cannot be replaced by Jellyfin. That is very disingenuous. To “replace” Netflix with Jellyfin requires a bit more infrastructure and while it might be cheaper there’s risk involved that isn’t present with your other changes.

That’s the problem with this distinction. Screen recording tools can create a file that is functionally identical to a downloaded file so it’s just a judge that doesn’t understand what’s going on. That’s scary.

For those that don’t know, he ultimately backed EME which was dumb.

I don’t think you understand what the tool is

Yes but we’re talking about zsh. I know zsh wasn’t on TiVo.

Shit I didn’t know this was a problem. What devices are these? I’m assuming we’ve got a few in every home?

Software co-ops are often indistinguishable from startups in the US. Without money they don’t matter and getting money turns you into a shitshow or requires full-time staff fighting for grants and other forms of not blood money. Maybe this is easier outside the US.

Fuck big tech tho

It’s a cynical way to view the C-staff of a company. I think it’s also inaccurate: from my limited experience, the people who run large tech companies really do want to deliver good software to users.

From my much broader experience, this is missing the required cynicism that C-staff want to deliver software they think is good based on the criteria cynical yes staff tell them constantly is good. I’ve never met an exec that didn’t want to deliver something good; most execs I’ve met don’t actually understand what good is or how to benefit people.