trevrosen@bluesky

snark | supply chain sec @GitHub | @projectsigstore TSC | opinions all mine

[trevrosen@bluesky @trevrosen]

@siddarthkay @jaredpalmer @github 👋 hi there! You hit a bug caused by some wonky Elastic indices. The fix has been rolling out the past couple days. You should see the correct content now. 😃

[trevrosen@bluesky @trevrosen]

@dhh @karololszacki “We find a nice rough stone and scrub our bodies in the river. Showers are decadent.”

[trevrosen@bluesky @trevrosen]

It’s alive!

Snowing sideways outside, but I’m excited to be here in Salt Lake City to focus on supply chain security!

#sigstorecon

[trevrosen@bluesky @trevrosen]

@ShriramKMurthi Love that feature! You can also use Automator to make new ones to do things like easily convert HEIC to JPEG.

[trevrosen@bluesky @trevrosen]

@its_The_Dr Nah no PDX vibe here for me. I’m going with “Shreveport smoke shop that mostly sells meth bubblers”

[Shannon Watts @shannonrwatts]

LFG!!!!!

[trevrosen@bluesky @trevrosen]

After many thousands of dollars and many happy stays in several countries, I’ve just had an incredibly negative with @Airbnb. @AirbnbHelp seemed to be deliberately obtuse. I’m absolutely baffled. I used to love this service. I’m looking for alternatives now.

[trevrosen@bluesky @trevrosen]

@deadprogram Wish I could be there!

[George Wallace @MrGeorgeWallace]

I'll straight up slumber at a retirement party and retire at a slumber party. I really don't give a shit anymore.

[trevrosen@bluesky @trevrosen]

Honestly this full-bore descent into anti-Semitism by Elmo et al might finally be it for me w/ this stupid site. I barely show up here anymore, but this is the first time I've seriously considered simply deleting my account.

[GitHub @github]

Got your ticket yet? https://t.co/0ifHPRdH8U

[trevrosen@bluesky @trevrosen]

@kcqon had a blast, @kcqon - thanks for coming to the talk!

[trevrosen@bluesky @trevrosen]

@cbirebbi @elonmusk IMO the company’s collective ethical failure surrounding the premature rollout of “self-driving” features (and the attendant horrifying parade of accidental death) is more relevant.

Tesla still has the crown for range, but GMC/Ford/Polestar are worth a look as well.

[Tammy Duckworth @SenDuckworth]

Every single Senate Republican just voted against FOUR bills that would make it easier for women in America to access reproductive healthcare.

The Republican party is anti-choice, anti-freedom and anti-women.

[trevrosen@bluesky @trevrosen]

@markdunbavan @danielcroe @npmjs @github @nuxt_js @projectsigstore @decodebytes @theopenssf Just to add a bit of context: the Package Security and npm teams at GitHub executed on all the CLI and registry work. Hats off to @feelepxyz, @bdehamer, @wraithgar, and @quitlahok for their efforts here!

I'm also grateful to @decodebytes and my fellow members of Sigstore TSC!

[trevrosen@bluesky @trevrosen]

@bitandbang @buildsghost @ag_dubs @npmjs @github @theopenssf I'm bad at Twitter, especially these days, but here's the spec for integrating. Sigstore will have a prettier page for all of this on https://t.co/nkJbkazcLt soon :-)

Var names etc will evolve toward this vendor-neutral pattern.

This is still a beta :-)

https://t.co/roWhTRlSb3

[trevrosen@bluesky @trevrosen]

@bitandbang @npmjs @github Sigstore is working to make the comms around this more user-friendly, but here's how any CI/CD that has an OIDC IdP can start integrations.

https://t.co/roWhTRlSb3

[trevrosen@bluesky @trevrosen]

This is been nearly a year in the making - really proud of the team and all they've built/overcome to get here!

[npm @npmjs]

starting today, developers building npm projects on @GitHub Actions can request a provenance statement to be published alongside their package, giving consumers a verifiable way to link a package back to its source repository and build instructions.
https://t.co/8zilYJz5Dc

[trevrosen@bluesky @trevrosen]

(And yes I know the companies aren’t comparable in size, it’s just funny to me)

[trevrosen@bluesky @trevrosen]

Fox News seems to have settled for less than News Corp paid for MySpace, adjusted for inflation.

Dominion Settlement: $787.5m

MySpace sale in 2005: $580m (https://t.co/TbGjgIl7X2)

MySpace in 2023 dollars: $898m (https://t.co/rQWYRbhEys)