Dr. Juande Santander-Vela

@ed_hawkins Also worth looking at, to better get the idea… https://m.xkcd.com/1732/

@ZachWeinersmith you’re going to be mises… but please follow there the Fediverse bridge…

https://fed.brid.gy/docs

See @bsky.brid.gy

@Di4na @foosel you can limit reproducibility of builds by keeping well known artifacts that you sign in your own infrastructure. And mandate commit signature to your own code.

@Di4na @foosel oh, I had not understood that, I was thinking of more general principles… and it never occurred to me that someone else could think otherwise.

At #SKAO we were creating our own images and repositories for dependencies, with their own security setups, because we understood we could not force that upstream.

@Di4na @foosel I’d argue that it is not sufficient to also provide your software with a well known FOSS license. That also means that you are now a “un-supplier" to others, it does not fix the need for owing back to your FOSS dependencies, specially if you are a large project.

@Di4na @foosel truer words have probably not been spoken yet this year 😉

Now, in all seriousness, this is spot on. Organizations that use FOSS must become part of the mesh, either by owning some of the work that needs to be done, or directly funding it, and preferably both.

@stux @juandesant ❤️⚽️🥦