Noah K

@geeksam @Ashedryden Jeremy Irons did a good turn too, but Dance is perfect.

@Ashedryden Yeah. Notable features include Charles Dance as Lord Vetinari (amazing) and good enough charisma from everyone except maybe Adora to carry the mild mangling of the story.

@Ashedryden Toys, live action Ghost in the Shell, Tomorrowland (maybe honorable mention for Going Postal TV movie adaption but that deserves like 60% of its under-rated-ness).

@robinadams I hope you plan to build that software in assembly on punchcards or something. It's easy to talk about local community software when you ignore the shoulders of giants on which pretty much everything stands.

@malwareminigun @chansecodina It would help a little, it would have created a new roadblock to this kind of attack. But in the end all that roadblock does is force an attacker to spend extra time finding a weak point somewhere in the strong-set, one person who is indirectly trusted but does a bad job vetting new friends. Maybe that adds a year to the timeline but we have 100% proof that these attackers are extremely patient so I don't feel much better overall. And of course the next time this happens, a human won't have been doing anything for that year, it will be some horrible LLM conglomeration spinning a loop with minimal oversight.

@malwareminigun I think you might be misunderstanding this as being about package security, which I'm not sure anyone is discussing web-of-trust for? The recent push between projects like Vouch and humans.json has been to do maintainer-level trust analysis. I posit this will be ineffective.

@malwareminigun To the best of my knowledge that is not true. What has been reconstructed of Jia (for lack of a better name) getting added was mostly via sock-puppets and pressure tactics. The original maintainer was effectively bullied into adding them, relatively cursory checks showed this person didn't exist until shortly before the attack started.

@malwareminigun Presumably in a WoT world, the original maintainers would have checked who vouched for this new guy before adding them as a maintainer. Which just moves the problem from "socially engineer a project owner" to "... someone a project owner trusts, directly or indirectly". This is kind of an improvement but not in a hugely meaningful way.

By all means invest in lifecycle security tools, BOMs are nice and package signature checks keep out the simple attacks. But they don't solve the deep social issue of mass collaboration at a planetary scale seems to be beyond the capabilities of our fragile brains. We are too easily taken in by things which appear to be a person which shares our values. Modern open-source leadership is effective a mental DDoS, and if that breaks down then what is going to replace it? If you think the AI coding models are advancing so well that we'll all soon just be coding via prompts alone then okay, I strongly disagree but that's at least a consistent world view. If not, genuinely where do we go from here. Having a thousand little webs-of-trust is not functionally better than having a million random "people", and that's being extremely generous on the scale of those webs.

I don't care if Dunbar's Number is real or what the value is but the slippery slope has slid, whatever the limit we are over it.

@glyph Love it, working on my talk proposal for PyCon AU and I seem to have settled on "building engineering processes that are resilient to human error".

@glyph Something in the air today maybe 🫠

@galaxykate Ingress (and thus Pokemon Go) started out from the GMaps dataset, if that counts :)

@galaxykate recognizing sign language or emoji faces from a camera feed are both popular, though 20m probably isn’t enough time to do it from scratch. Maybe with a pre built notebook?