tomviner

Diver of sea, sky & board.
Developer of Software.
Principal dev at @Sohonet
Organiser, lead heckler @ldnpydojo

[Patricia Marins @pati_marins64]

Today, Donald Trump paused Operation Project Freedom and, just as he did with the war, ended it without achieving any objectives.

For those looking for the answer as to why he sent two destroyers through the Strait of Hormuz, the answer is that he needed a victory speech, even if strategically it meant nothing.

Trump backed down because his Project Freedom idea was creating a permanent war, and he remained under pressure from the markets.

He then managed to get Iran to agree to give him a victory speech in exchange for dropping the talk of reopening the strait by force, at least for now.

Obviously, this is temporary and aimed at relieving the market pressure on him.
None of this removes the stigma of defeat from Trump and Netanyahu, but it buys them some time.

It is exactly at this point that Iran continues to make a mistake, collaborating to relieve this pressure in exchange for benefits, in this case, continuing to export. All behind the scenes.

On March 5, I wrote this:
“It was supposed to be 4 weeks, which turned into 8, and now they’re talking about 100 days. Observe why Israel and the US underestimated Iran and run the risk of emerging from this defeated, not by Iran, but by the global market.”

https://t.co/dDfH5MZjrx

It’s not about the Iran, but about the markets.

I would say there’s still plenty of fuel left to burn in this bonfire.

[tomviner @tomviner]

"But gaps between discourse and reality can only close in one direction"

[Policy Tensor @policytensor]

The Iranians called his bluff. It’s just a fact that denial of commercial transit is far, far easier than securing navigation. It cannot be done without disarming Iran. This little episode reinforces Iranian control of Hormuz.

There was also ‘a threat that leaves something to chance’ in his stratagem. He was daring the Iranians to run the risk of war to enforce their control of Hormuz. The Iranians did not flinch.

Where does this episode leave us?

First, Hormuz will not reopen until at least a preliminary deal is reached with Iran. And that still requires lifting the blockade and ordering the Israelis to stand down in Lebanon.

Second, he tried this cheap trick because the fundamental reality is that the US is out of real alternatives to actual two-sided negotiations.

Frozen conflict with Hormuz closed continuously tightens the noose around his neck. Going back to war will not only run down the US magazine, likely lead to the closure of the Red Sea as well, and cause massive destruction in UAE and Israel at least. It also runs the risk of further unrecoverable losses for the US military itself, including the destruction of the surviving bases.

Even if he is prepared to pay the full price, as the hasbara commissars are demanding, it is highly improbable that the US can defeat Iran, since the only way to defeat Iran is to disarm it, and by now it is beyond reasonable doubt that the US does not have the capability to do that.

No one said losing the empire was going to be cake walk. It’s humiliating. It requires a fundamental reconsideration of the picture of the world in their heads. It’s going to be a drawn-out, violent process. But gaps between discourse and reality can only close in one direction.

[tomviner @tomviner]

@waitbutwhy

[tomviner @tomviner]

@ProfessorPape So $75 up to $105 then

[tomviner @tomviner]

@policytensor If defeating the US is proof, you should explain why other defeaters of the US (N. Vietnam, Taliban-Afghanistan, Iraq) and defeaters of other great powers (Afghanistan/USSR, Algeria/France, Haiti/France) are not great powers.

[Bailey Pumfleet @pumfleet]

Open source is dead.

That’s not a statement we ever thought we’d make.

@calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up.

AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost.

In that world, transparency becomes exposure. Especially at scale.

After a lot of deliberation, we’ve made the decision to close the core @calcom codebase.

This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible.

We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple:

Protecting our customers and community at all costs.

This may not be the most popular call.

But we believe many companies will come to the same conclusion.

My full explanation below ↓

[tomviner @tomviner]

"dockerfile-roast" - what a name

[Immanuel @immanuel_vibe]

unpopular dockerfile takes (that actually work)

1 - stop using alpine — yes, it's tiny. but musl libc ≠ glibc. your python/node app will rebuild native deps from scratch or just... silently be slower. use -slim (debian-slim) instead. same size win, zero grief.

2 - layer order is your cache strategy. COPY your lockfile first, run install, then copy source. invalidating the install layer on every code change is a skill issue ngl

3 - multi-stage builds aren't just "best practice" — they're the actual reason your prod image doesn't ship gcc and 400mb of build tools. builder stage = bloat zone. final stage = lean mean container.

4 - COPY . . is fine actually — if your .dockerignore is correct. most pain here is from forgetting to ignore node_modules/, .git, *.log. fix the ignore file, not the COPY.

5 - one process per container is a vibe, not a law. if your app needs nginx + app server and you're not at k8s scale — just use supervisord. the "one process" dogma costs more complexity than it saves sometimes.

6 - pin your base image by digest, not tag. node:20 today ≠ node:20 in 6 months. prod broke because of a tag? that's a you problem tbh.

7 - BuildKit cache mounts (--mount=type=cache) will change your life. pip/apt/cargo cache between builds without it ending up in the final layer. nobody talks about this enough fr

there's no "best practice" in a vacuum. alpine is great for Go binaries. slim is great for Python. scratch is great for static bins. know your workload, then choose.

btw if you want something to catch all this stuff automatically -
check out dockerfile-roast — a linter written in Rust that literally roasts your Dockerfile. 63 rules, brutally honest output (but it can also provide just dry facts, no roast), runs on any OS or as a docker container
https://t.co/NVYpe8iD65

#docker #devops #kubernetes #backend #linux #rust #sre #containers

[Boshen @boshen_c]

Reading "Open source security at Astral" and noticed the author is the person who created zizmor, and their last name has ruff in it.

@charliermarsh how the f did you pull this off???

https://t.co/99PwMxiO9T

[tomviner @tomviner]

@simonw Community screening of packages needs what uv calls "reproducible resolution" which they explain in terms of absolute dates

eg `uvx --exclude-newer <datetime of tweet> pkg=1.2.3` means readers can accumulate crowd source auditing of a unchangeable entity
https://t.co/BTdUamftvb

[Anthropic @AnthropicAI]

Mythos Preview has already found thousands of high-severity vulnerabilities—including some in every major operating system and web browser.

[tomviner @tomviner]

@simonw Community screening of packages needs what uv calls "reproducible resolution" which they explain in terms of absolute dates

eg `uvx --exclude-newer <datetime of tweet> pkg=1.2.3` means readers can accumulate crowd source auditing of a unchangeable entity
https://t.co/BTdUamftvb

[tomviner @tomviner]

https://t.co/6mzW4oYPW7

[tomviner @tomviner]

@zooba @willmcgugan ok sure, but when running that command, wouldn't it be even safer to have a cooldown of say 3 days, so you never pick up hyper-fresh danger-packages

[tomviner @tomviner]

@zooba @willmcgugan Lockfiles and scheduled re-locks

Could you explain or do you have a link for this approach?

[tomviner @tomviner]

@FlyGirlaviatrix @AuronMacintyre @ggreenwald @grok which of this is true and which false. If any

[tomviner @tomviner]

@FlyGirlaviatrix @AuronMacintyre @ggreenwald Which of this is true and which false. If any

[tomviner @tomviner]

@simonw @github Just don't forget the starting directory is not inside your repo, it's above, like you just ran `git clone`

[tomviner @tomviner]

@simonw @github And this works instead of using the Setup script box: