180 karma · joined September 5, 2020
I really wonder when companies will start hosting theire model for everday tasks on prem, cause its good enough (and realative cheap), instead of paying subscriptions for all devs.
We help admins to manage ssh access (using certificates & ouath) for sme and hobbiests.
A ssh ca (that issues short lived < 5 min certs) that is easy to setup and operate, focusing on oidc as a auth provider (entra keycloak for now), to authorize users not keys.
Using 2fa to guard servers and keys from compromises.
Also I checked how many deps vuejs has, also 0.
Also move or die is running on love2d, which is an awesome game.
Also I love that trick that you can just zip your files and binary Comcast them to the love2d binary and it will load it.
Im a software dev, so not that much hardware experience
1. Only the registry itself can build packages (only source provided) 2. Builds must be reproducable (no network or external files during build / publish) 3. New versions are hidden by default 4. Releases can only be published by an account, using a hardware 2fa token + password (no persistent login, no long lasting token) 5. All commits must be signed (maybe block web commits or add a cooldown of a few days?) 6. builtin scanners (using ai, virustotal, existing services) 7. if a security violation is found the version is instantly removed 8. Atleast 1 - 3 Days delay for releases 9. Hard no on binaries / post install scripts and binary data 10. blockchain like public record to see who published, updated, owns what