Will Woods

Software Engineer, formerly @redhat. Thinks too much about packaging systems and software supply chain security. The mustard indicates progress. 🌭

[Will Woods @__ww__]

permanent reminder to self

[wint32_t @dril_rs]

one of the things i dont “get” about rustc is why can’t you index out of bounds. c gives me “bonus data” but no. rustc always jsut gives me shit

[qntm @qntm]

The best proof that time travel is impossible is that sixty thousand misconfigured time machines from all phases of future history didn't simultaneously explode into existence at midnight UTC on 1 January 1970

[neural oscillator of uncertain significance @mycoliza]

“a hot dog is just an interface that can abstract over any form of meat”

[Jens Axboe @axboe]

"Running a successful open source project is just Good Will Hunting in reverse, where you start out as a respected genius and end up being a janitor who gets into fights."

Quote attributed to @cra, and I don't think I've ever seen anything more true posted.

[Allen Holub. https://linkedIn.com/in/allenholub @allenholub]

If you're doing Scrum and estimating or breaking up stories into tasks, you may want to reconsider. From the horses mouth: 👇

[Will Woods @__ww__]

@BrianDilkes @FunnelFiasco this guy gets it

[Will Woods @__ww__]

@stewartsmith @mattdm @QuinnyPig @BitIntegrity @_msw_ ...and this is where everyone goes "that sounds like a lot of work, let's Leverage Existing Infrastructure and Wrap It In A Simplified Format"

'cuz who wants to pay people to *solve* problems when you can just hide them under a new layer of archives + metadata + shell scripts?

[Will Woods @__ww__]

@Arrfab @BitIntegrity @_msw_ was actually considering using technologies invented *after* the 1970s. radical, i know

[Matthew Garrett (@[email protected]) @mjg59]

"Zero Trust" is not supposed to mean "Destroy all trust that people previously placed in you"

[Tim Bray @timbray]

Fascinating deep-dive, must-read.

[Arrigo Triulzi @cynicalsecurity]

PoC||GTFO 0x21, "Notebook of Altera NIOS Disassembly, Routable IPIP Spoofing, PCAP-NG Polyglots, Weird Machinery, Code Golfing, and UHF-VHF Tuners", is now available on #OpenBSD over #IPv4 and #IPv6 ¹:

__
¹ https://t.co/qD2iVPJ0x6

[Will Woods @__ww__]

[sweating visibly] you.. uh.. you telling me a Borrower checked this compiler

[Will Woods @__ww__]

The problem with "find an itch to scratch" as a development methodology is that all software makes me fucking itchy

[Will Woods @__ww__]

@vathpela ...what patents?

[Will Woods @__ww__]

boy am I ever fucking tired.

[✴︎ kitt ✴︎ @profeshkitten]

If you’re so smart, why aren’t you kind?

[⚡️🌙 @dystopiabreaker]

since everyone is talking about log4j/supply chains

an experiment years ago i calculated 1-bit offset utf8 strings of the top few hundred npm packages and registered packages under them

they received thousands of hits per week from machines trying to download and execute them

[Will Woods @__ww__]

@passcod @zkat__ nope! there's literally no way to prove this in current systems. the best we can do is stuff like: "well, this RPM has Red Hat's signature, and the RPM metadata claims its source tarball hash was [xxx].. good enough, right?"