Pete Wagner

Infra security nerd at Shopify. Previously GitHub (Dependabot+Actions), ApolloGraphQL, Fitbit. Hack the planet.

[Pete Wagner @meofthecloud]

bonus: most of my tweets are "i built a thing + screenshot"

https://t.co/deV7uNYG3f

[Pete Wagner @meofthecloud]

@ibuildthecloud Is this for AI chat? Or the Kube thing? I mentioned my DIY chat frontend before, here's a screenshot.

Rendered markdown inside some rounded borders, and a pulsing spinner while the bot is generating a response. Functional garbage.

[Pete Wagner @meofthecloud]

my PR to trivy made its way to trivy-action, so now my SBOM dependency diffs include the golang stdlib for any detected binaries. neat. https://t.co/wuR1v46RQi

[Pete Wagner @meofthecloud]

if you're trying the shiny new `gh attestation verify` with reusable workflows, don't get sniped into debugging the CLI like I did: https://t.co/vc3nC8Ze7m

[Pete Wagner @meofthecloud]

@StackLokHQ I appreciate that `gh` is the only binary I'm willing to trust without seeing a signature in Rekor first. I think moving the magic from GoReleaser (the common thread in the "good" projects I mentioned) to the GitHub platform will let me verify more and configure less.

[Pete Wagner @meofthecloud]

Early adopters of github attestions:
https://t.co/LodNj8PxP9 (shout out @StackLokHQ !)

I don't see anyone signing a .deb yet, I was hoping to adapt some `cosign verify-blob` based stuff.

[Pete Wagner @meofthecloud]

@StackLokHQ My interest is from my verifying Debian proxy. Projects like Trivy, SOPS, and GoReleaser provide attestations via cosign sign-blob, so I have a service that let's me "apt-get" updates as long as I trust their signer.
The config file explains it best: https://t.co/kzeJgBY34i

[Pete Wagner @meofthecloud]

@ibuildthecloud Rolling your own with charm libs isn't too bad - mine is a Bubbles Viewport+TextInput. Add Glamour to style the markdown, a few borders, ship it.

It's still as un-fun as writing UI code, but at least it's Golang.

[Pete Wagner @meofthecloud]

@gudmundur Do you see value in an LLM for this, or is there too much domain knowledge? I've been fiddling with markdown timelines in an LLM as a rubber duck on steroids, I'd say it's only 25% gibberish .

[Pete Wagner @meofthecloud]

@lorenc_dan I built this ~2 years ago: https://t.co/cKHh99FiWH - I used rego as the policy language otherwise it's pretty similar.

[Pete Wagner @meofthecloud]

@ibuildthecloud I did a thing that drops an LLM agent into a simulated world (a 10x10 grid with randomly distributed "food") and let it issue commands to survive.

Local models could barely speak JSON and I had to hand-feed them tokens (e.g. to "move_west", prompt: "there is food to the west")

[Pete Wagner @meofthecloud]

How can a ski hill be open with a small amount of natural snow?

Snowmakers go BRRRRR.

[Pete Wagner @meofthecloud]

I wanted this enough to build it again: a service to generate Debian repositories in-memory from a bunch of debs. It can source packages directly from GitHub release assets and verify Rekor records produced by cosign sign-blob.

[Pete Wagner @meofthecloud]

Until you pin your dependencies George, Festivus is not over

[Pete Wagner @meofthecloud]

i spilled making a pourover and knew i had exactly 23.5g of coffee to clean up off the counter.

ever catch yourself napkin mathing literal napkin math.

[Pete Wagner @meofthecloud]

@marccampbell I've scripted rotations: have a bot that generates tokens from a GitHub app and stores them as a secret for each repository to use: https://t.co/aNZn7HeyTx
Now I host a service that issues tokens to workflows as needed via Rego policy: https://t.co/cKHh99FiWH

[Pete Wagner @meofthecloud]

more tech clutter tips: "does this SPARC? joy"

[Pete Wagner @meofthecloud]

the SSD rule of thumb is literal: once you have several thumbdrives larger than a 2.5" SSD, that SSD is probably waste.

[Pete Wagner @meofthecloud]

@jessfraz I’m convinced this will be the new typo-squatting. Nobody fat fingers what they copy/paste from GPT, so squat packages that bots will assume exist.

[Pete Wagner @meofthecloud]

"this is man chmod(1), i wanted man chmod(2)" - statement dreamed up by the utterly Deranged