varunsharma07

Nice! This brought back memories of a car game I had coded in C in MS-DOS while in college.

It first asked me to log in and said I had no credits and needed to purchase them. So I could not try it. I don't know if this fits into Show HN. I suggest having a free tier where people can at least try it.

Suggestion: Please add a license and fill out the About section in the GitHub repo.

no worries

Nice! Can you add the https://hntoast.com URL to this post in the URL section? I had to copy-paste it.

Good point. As a user, I still want to click on a final unsubscribe button and not just unsubscribe automatically.

I think this should not be a problem with the proper compliance certifications (SOC 2, PCI, etc.). Similar logic applies to Auth0 and even using cloud computing, for that matter.

I don't know how adequate such vetting is. It puts the onus on the developers to look at the results and decide. Is there work being done to sandbox extensions?

Is there something for logo generation?

Nice! Would you happen to know what Azure uses for this? https://feedback.azure.com/d365community/

I wonder what the pros and cons are between that and what you are building.

It would be great if it could support NoSQL databases as well. I use DynamoDb as an example, and I had to write REST APIs myself.

Is this functionality not included with MS Word?

Meditations by Marcus Aurelius https://www.goodreads.com/book/show/30659.Meditations

Interesting! How does it handle credentials for creating pull requests? Do I need to install an App?

I believe Gmail already has this feature: https://www.mailjet.com/blog/deliverability/understanding-gm...

I have used the feature in Gmail, and do like it.

How to Strengthen Your Software Supply Chain Security, Improve Best Practices, and Build Trust in Your Projects

I was going to bring up Maslow's pyramid of needs. I think that is what drives us. Different needs at different times in one's life.

A list of hand-picked actions for security scans and guardrails for your pipelines, infrastructure, source code, base images, and dependent libraries

Thanks! This is another interesting issue where unnecessary services were discovered and disabled on the GitHub-hosted runner because of Harden-Runner because these services made unnecessary outbound calls. https://github.com/actions/runner-images/issues/4867

Awesome!

Great idea! How do you plan to overcome potential rate limits or need for authentication for some of the forums?

How does this compare with secret managers like HashiCorp vault, Azure Key Vault, AWS Secrets manager, etc.? Are some of those needed to use this? Or can those be replaced with Infisical?

Git Security Assessment Full Report is here: https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitla...

Good read on the security improvements Eclipse Foundation is working on. The first section discusses using GitOps/ "as-code" to manage repositories...

Stumbled upon this talk from 2019. Are there other similar projects for GitOps to manage GitHub org?

It has numbers on the recent layoffs by Microsoft and Amazon. Information in the database is displayed by the date Employment Security receives the WARN notice.

Good read about the different working groups and the progress made by OpenSSF in 2022.

While OIDC is a good option, at StepSecurity, we are building an open-source project that allows using your MFA tokens for deployments in CI/ CD. So far, it is implemented for GitHub Actions - https://github.com/step-security/wait-for-secrets. In this method, you get a link in the build log, click the link, and can enter credentials at run time, which then gets used in the next step in the pipeline for deployment. So there are no persistent secrets stored in the CI/ CD pipeline and no need for managing/ rotating separate deployment credentials.

If using GitHub Actions for CI/ CD, Harden Runner (https://github.com/step-security/harden-runner) can be used to audit and block DNS exfiltration. Outbound calls from CI are predictable (to source repo, artifact registry, etc.) and don't change often.

If CI/ CD pipeline uses GitHub Actions, you can monitor and even block outbound network calls at the DNS and network level using Harden Runner (https://github.com/step-security/harden-runner). It can also detect overwrite of files in the working directory. Harden Runner would have caught this dependency confusion and similar attacks due to a call to the attacker endpoint.