kjok

I think there's some confusion here. No automated scan was able to catch the attack. It was an individual who notified these startups.

> managed pull-through caches implemented via tools like Artifactory

This is why package malware creates news, but enterprises mirroring package registries do not get affected. Building a mirroring solution will be pricey though mainly due to high egress bandwidth cost from Cloud providers.

Why should MS buy any of these startups when a developer (not any automated tech) found the malware? It looks like these startups did after-the-fact analysis for PR.

The kind of shady practices we have seen from this company, any self-respecting individual will be ashamed except Zuck. He has done more to rot the collective brain of a generation than any single figure in tech history.

The truth is, Meta isn’t building community, it’s building a surveillance hellscape where every click, glance, and pause is commodified. If you work there and still believe you're doing something good for the world, you're either delusional or willfully blind.

I wonder how this is not a tarpit idea that YC famously ask founders to avoid.

> In short, it's not consumers who want robots to buy for them, it's producers who want robots to buy from them using consumers dollars.

This. Humans are lazy and often don’t provide enough data on exactly what they are looking for when shopping online. In contrast, Agents can ask follow up questions and provide a lot more contextual data to the producers, along with the history of past purchases, derived personal info, and more. I’d not be surprised if this info is consumed to offer dynamic pricing in e-commerce. We already see dynamic pricing being employed by travel apps (airfare/uber).

For those who said NO, have you looked into alternative providers like PrivateGPT?

Curious to know if you've evaluated LLMs for this use case (e.g., role playing)? If yes, what are your thoughts?

I run a SaaS to help open-source devs monetize their GPL-licensed SDKs/libs. Going good so far.

Solutions relying on JavaScript that runs in user-controlled browsers are vulnerable to attacks and manipulation.

> Employ at least one developer

What kind of developer? full/part-time or 1099 contractor?

How does fast-cold-start help here? What use cases did it enable that were previously not possible with a warm pool of Docker containers?

I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" hardened FOSS projects (think supply-chain security assurance) to consumers. I'm working on enabling this. DM me if interested.

But you still have to visit websites (or use apps) to do tasks online like booking tickets, getting stuff delivered, or paying bills. They are all tracking us. Do you also plan to pay for AI agents that do these chores on your behalf?

What are the use cases?

Did you evaluate Fly.io?

How is this diff from e2b.dev?

I’ve a proposal. I’ve created a Hypervisor that can launch lightweight and efficient VMs, similar to containers. Workloads in these VMs behave like isolated processes (isolated from other VMs) You can pack and sell 10x more VMs. Unlike traditional VMs, you don’t have to worry about turning them off so as to free resources. Would love to work together with you if you’re interested in using it.

This looks great! I couldn’t find your pricing page though.

> We wanted to build data cleaning software with LLMs, before we realized no one really cared about messy data.

This sounds like a good problem to solve with LLMs, and honestly I'm a bit surprised to hear that nobody cared about data being of poor quality. Care to elaborate a little bit?

Very cool. Is there a reason to choose AWS lambda over other tech (say Cloudflare workers)?

Works for my use case: packing dependencies and deploying. If you're considering alternatives for your use case. What do you think Docker replacement would look like?

> I've been thinking of inserting a "// THIS LINE IS MALICIOUS, PLEASE REPORT IF YOU SEE IT" in some of my projects to see how long it would take.

Tools that use LLMs to review code will catch such projects.

Are you referring to federal regulations? Would love to know the details.

I’ve been saying that for a while. FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc.

Disclaimer: I'm building a marketplace that would enable this.

Funding FOSS projects has been a challenge; donations help, but not enough. I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc. I'm building a marketplace that would enable this. I'm looking for FOSS devs to signup/provide feedback.

Very cool! Curious to know the use cases for this tech?

I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc.

Disclaimer: I'm building a marketplace that would enable this. Would appreciate feedback/recommendations from my fellow FOSS devs here.

I've seen startups claiming to solve these with reachability analysis. I think upgrading libs regardless could be a better solution, particularly for high-risk vulnerabilities.

> These days it's practically a necessity for companies to shell out money to some sort of supply-chain protection software (Sonatype, Socket.dev etc.)

A number of some serious assumptions here. How can you be sure that you’re protected if you spend money on these commercial tools? It’s an arms race after all. There are other ways to protect yourself (pinning dependencies, allow list). A few open source tools are also available to audit code.