back
user profile
mmarian
1,459karma·1,053submissions·July 28, 2019
about
Latest projects:
* AI Copilot for LibreOffice Writer: https://librethinker.com/
* A personal blog about tech and startups: https://developerwithacat.com
* Hacker News alerts for comments and replies: https://hackernewsalerts.com/
I open source my failed projects at: https://github.com/mihailthebuilder
I'm on LinkedIn for anything: https://linkedin.com/in/mihailmarian . Make sure you add a message before you send a connection invite.
recent activity (1,053 total)
comment
Dust or obscurity ^_^
comment
Yes, it's maddening. Especially since it's a fair amount of effort to move to commit SHA pinning and establish a good maintenance/monitoring process around it; if I knew it would be ado…
comment
Few, if any. Which is why I'm highlighting that you can't just use commit SHA + Renovate then call it a day.
comment
How would that solve the problem though? You're still bringing compromises in, just with a delay. And the fixes will come in after the compromise, in accordance with the delay policy. To make mat…
comment
Oh, nice, will look into it, thanks! Let me know if you're aware of any other tools that do this. I had a look before and couldn't find any.
comment
I mention in the posts the problem with the likes of Renovate. Auto merging is equivalent to semantic versioning. You have to properly vet the influx of updates, and that unfortunately won't work…
comment
I agree, silly limitation. On zizmor, there's no mention of coverage on commit SHA the section you've linked, nor in the entire page when I do Ctrl+F. Is there anything I'm missing?
comment
I used to think whitelist could be a partial solution. But after Checkmarx KICS got compromised I can't see this working. I would've considered a well-established brand, in security industry…
comment
Agreed. Good news is GitHub will address that with Immutable Releases https://github.blog/news-insights/product-news/whats-coming-... You won't even need to use commit …
comment
If you auto merge those PRs you're back to square 1 as you're not vetting your dependency updates. And if you don't, you incur operational overhead unless you put in a fair amount of ef…
comment
There are downsides to it though. You...
- lose vulnerability alerts
- increase maintenance overhead
- take on all that for value that will go to 0 once Immutable Releases gets widely adopted I wrote …
comment
I do that too. Wouldn't say it's relying on the logic. It's more hearing another perspective. Sometimes I think what it's saying makes sense, sometimes I don't.
comment
Yep, I've done that a few times, eg https://developerwithacat.com/blog/052025/postmortem-company... Quite cathartic. And I occasionally share it in some conversations t…
comment
Just Googled "cost of smokers in UK", and first result I got - total annual economic cost of £46B, for England alone https://ash.org.uk/media-centre/news/press-rele…
comment
Just let the taxpayer funded healthcare system deal with the burden. See how you can go the other way too if you want to be objective :)
comment
Meetups tend to have huge backlogs for speakers. Tried it in a couple and they said 8 months at least.
comment
Review the methodology, if you can, and form your own conclusions. Don't bother trying to change people's minds. It rarely works, and often causes conflict, even in the case of people who sa…
comment
Democratization of software through SaaS & new engineers brought Airtable, Smartsheet, Baserow, Monday, and many more that I can't remember though.
comment
My personal use case is a replacement for pandas for ad hoc analysis in Jupyter notebooks, which I have to do very often these days. If I had to store the data I'd pick S3+Glue+Athena.
comment
With my enterprise hat on, I'd say Athena + S3 is good enough. Only use DuckDB for ad hoc analysis.
comment
Probably because you probably don't have to do those arbitrary transformations that often. I do, being in a security-related role. But I wouldn't have recognized its usefulness in my previou…
comment
Yep. And easy to reuse as well since it's just SQL.
comment
It's been a lifesaver for some analysis I had to do on 70GB of Cloudflare logs.
comment
Oh, thanks, didn't look at the feed before submitting. It's a dupe indeed.
2 pts