craigbro

craigbro, 5 days ago to random

Recent CVE in #git allowing RCE when cloning a repo, see https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv

Note it says, "As always, it is best to avoid cloning repositories from untrusted sources."

Now consider how many languages will clone a repo of a transitive dependency, or direct dependency at time of dep resolution -- often before any dep analysis/presentation tools could give you a means to evaluate the transitive git deps.

Like #clojure, one of my favorites. I have not review dep resolution/fetch code in other languages, but it seems that they should all heed the advice in that advisory.

baldur, 29 days ago to random

So, my dad is an organisational psychologist. Now retired but his career has included being the Chief of Staff at an org that employed around 1.5% of working Icelandic population at the time and decades of management consulting work…

Every time I explain to him how software cos and teams are managed he gets this look of disbelief on his face like I’ve just told him that gray aliens have landed in a flying saucer outside the Blue Lagoon and have set up a hot dog stand 😅

tk, 29 days ago to motorcycles

Are today's airbag vests any good? #motorcycle