R
The trivy heist cascading worries me greatly. It shows again how quick stolen credentials can be used to infect other packages and even ecosystems. Really seems a new magnitude from the npmjs worms back then.
Basically my conclusion has to be to not run packages, for which there is no attestation that's at least 30 days old, delegating the risk to others and hoping that maintainers notice in time.
@ftp_alun I can imagine people getting very excited that their fraud detection is getting better. That, and the inquiries also seem to suggest a good amount of racism and prejudice against postmasters.
@pietkuip how so?
I suspect most people outside of the UK won't have heard about the post office scandal, but it seems highly relevant to learn about now (given *waves* this):
For over 15 years, the software post offices in the UK had to use contained severe bugs, particular in accounting, that everyone at Fujitsu/horizon and the post blissfully ignored. Over 900 (!!!) postmasters were sentenced for alleged theft and fraud, some went to jail, some committed suicide. All because the software was shit and everyone who could do something about it didn't care and swept it under the rug.
Everything, including how it was uncovered, about this seems bizarre and Kafkaesque, but we better prepare for it to happen more often.
People seem to have learned NOTHING from the Post Office Horizon Scandal. The AI bubble is PREDICATED on software productivity being prioritised over anything being any good. PEOPLE WILL DIE.
types.pl (types.pl)
