HNHacker News
TopNewBestAskShowJobs

woodruffw

42,208 karma · joined May 26, 2015

I'm a Software Engineer in New York City. Before that, I studied philosophy.

On the philosophy side, I'm chiefly interested in metaphysics (ontology and mathematics/formal systems & semantics) and deontological ethics (praise and blame, moral education, honesty & bad faith).

On the computational side, I'm chiefly interested in program analysis (compilers), security (compilers), and systems (compilers). I do a decent amount of professional open source work on projects that encompass some of those.

My opinions are my own and do not reflect those of any employer, institutions, affiliates, lovers or haters past, present, or future. They might not even be mine anymore!

Sites: https://yossarian.net / https://blog.yossarian.net / @yossarian@infosec.exchange

submissionscomments

Brocards for Vulnerability Triage

vulnbrocards.com·1 pts·woodruffw·
0

PyPI: The HTML representation of the index API is frozen

blog.pypi.org·4 pts·woodruffw·
1

GitHub Actions needs OIDC audience constraints

blog.yossarian.net·2 pts·woodruffw·
0

Readme, Not

blog.yossarian.net·3 pts·woodruffw·
0

Dependabot version updates introduce default package cooldown

github.blog·209 pts·woodruffw·
143

You shouldn't trust Trusted Publishing

blog.yossarian.net·29 pts·woodruffw·
0

We hardened zizmor's GitHub Actions static analyzer

blog.trailofbits.com·5 pts·woodruffw·
0

Listen to PyPI

miketheman.github.io·8 pts·woodruffw·
0

Brocards for Vulnerability Triage

blog.yossarian.net·22 pts·woodruffw·
0

Open Source Security at Astral

astral.sh·37 pts·woodruffw·
4

Some Flexibility with Go's Sumdb

blog.yossarian.net·1 pts·woodruffw·
0

Serde's borrowing can be treacherous

yossarian.net·6 pts·woodruffw·
0

Moving Beyond the NPM Elliptic Package

soatok.blog·8 pts·woodruffw·
1

Python's splitlines does more than just newlines

yossarian.net·33 pts·woodruffw·
3

Safari has built-in WebDriver support

yossarian.net·2 pts·woodruffw·
0

Supply chain attacks are exploiting our assumptions

blog.trailofbits.com·9 pts·woodruffw·
0

Dear GitHub: no YAML anchors, please

blog.yossarian.net·178 pts·woodruffw·
151

Fun with Finite State Transducers

blog.yossarian.net·45 pts·woodruffw·
7

Show HN: Zizmor, static analysis for GitHub Actions

docs.zizmor.sh·3 pts·woodruffw·
0

Bypassing GitHub Actions policies in the dumbest way possible

blog.yossarian.net·247 pts·woodruffw·
119

Preserving old GitHub Pages URLs while migrating a repo

yossarian.net·1 pts·woodruffw·
0

Making PyPI's test suite 81% faster

blog.trailofbits.com·11 pts·woodruffw·
2

A New ASN.1 API for Python

blog.trailofbits.com·171 pts·woodruffw·
124

Any program can be a GitHub Actions shell

yossarian.net·282 pts·woodruffw·
101

Open Tech Fund vs. Kari Lake [pdf]

opentech.fund·4 pts·woodruffw·
1

Benchmarking OpenSearch and Elasticsearch

blog.trailofbits.com·3 pts·woodruffw·
0

When NULL isn't null: mapping memory at 0x0 on Linux

disconnect3d.pl·5 pts·woodruffw·
1

Don't Recurse on Untrusted Input

blog.trailofbits.com·3 pts·woodruffw·
0

Homebrew's new Git signing key

brew.sh·3 pts·woodruffw·
0

PyPI Now Supports Project Archival

blog.pypi.org·36 pts·woodruffw·
0
Page 1 of 8Next →