open source interloper; attracts bugs easily
אַ ביסל ייִדיש־פּאָסטינג
@SnoopJ@hachyderm.io @kojoidrissa@fosstodon.org I think the inconsistency is surprising, but IMO int() should actually do neither this nor other non-western-arabic numbering schemes! it's IMO a good example of two (eminently) reasonable concerns being mixed rather than properly isolated -- int() should turn non-formatted western arabic digits into numbers, and there should probably be an int.parse() or similar API that can handle different numeral systems, i18n, infixes, etc.
the JSON schema claims that composite actions support parallel but the runners suggest otherwise
so many downstream questions not answered by the docs: can background and wait be used with expressions, or just literal booleans? will this eventually work with composite actions too?
this MSRC saga seems destined to be canonized as an almost flawless example of how to implode community trust in a security setting through entirely unforced errors
copilot was already pretty mid, impressive how they’ve managed to make me dislike it even more by exhausting my quota on nothing except inline suggestions in…24 hours
on one hand, the competitive market is a compelling theory. on the other hand, billions of dollars have failed to produce an EDR that doesn’t suck shit
@trailofbits@infosec.exchange recently spent several months contributing to zizmor, and wrote up their improvements here:
https://blog.trailofbits.com/2026/05/22/we-hardened-zizmors-github-actions-static-analyzer/
This work was really great: they got into some of the low and ugly bits that I’ve been procrastinating on, and in the process made zizmor significantly more correct and useful. Thanks to @DarkaMaul@infosec.exchange in particular for his hard and thoughtful work on anchors and expression parsing correctness!
huge thanks to @veeso_dev@hachyderm.io for sponsoring me on GitHub!
(sponsors are part of what keeps zizmor sustainable. please consider sponsoring!)
people somewhat frequently complain about Python packaging’s assumption that each package can only resolve to a single version, but I actually think that was a pretty great outcome compared to having 3+ incompatible versions of the same package in your dep tree. Good example of constraints (even unintended ones) being liberating
@hynek@mastodon.social @jezdez@publicidentity.net gh api /user has it if you're authed!
Registering my dissatisfaction with GitHub
https://blog.yossarian.net/2026/04/29/Registering-my-dissatisfaction-with-GitHub
zizmor 1.24 is released! lots of bugfixes and features/enhancements:
@joshbressers @ancoghlan @hugovk it gets tricky when it's something that's contextually secure, e.g. http.server is secure under my attacker model when I'm running it on localhost, and I like that Python has it. but I'm sure the CPython folks are very tired of getting vuln reports for it!
Brocards for vulnerability triage
https://blog.yossarian.net/2026/04/11/Brocards-for-vulnerability-triage
I'm starting to think that the civic/community/sustainability risks around LLMs in open source are a little more of the "eternal September" variety than I originally believed
@westonsteimel hmm, like something where zizmor warns you to always explicitly put permissions: {}, even if all jobs are already down-scoped? That’s something I’d consider adding as a pedantic or auditor finding to zizmor, but I’m not aware of anything else that does that
