Notices by muesli (fribbledom@mastodon.social), page 32

@lachs0r

Well, yes, but what's the alternative you're suggesting?

This is why it's important to depend on well-maintained libraries.

If they have good reasons to depend on different versions, they can technically do that.

If that means they're inheriting a security risk from one of their dependencies, though, then it becomes their issue (and yours by inheritance) to deal with.

@lachs0r

There is no importing _random_ shit though. You pin _and_ checksum a dependency with Go modules.

It refuses to build if there's a checksum mismatch.

@lachs0r

But is it really? I think you underestimate how young the language and ecosystem is and ignore what they achieved with "dep" and Go modules in recent years.

It gives you all the tools you need to achieve reproducible builds now.

We need a system that lets us reproduce a packager's work and confirm that whatever they release was indeed built from a specific source tree without any unintended or even malicious changes.

To achieve that we require reproducible builds, so we can correlate a build with its source tree(s) and dependencies.

Whenever a new package gets released, this would allow independent systems and entities to verify that its contents really match the expectations.

Thread:

We need to talk about packaging, signatures, checksums and reproducible builds:

On your system you have a keyring of packagers' GPG keys that you inherently trust.

Releases get signed with a key, which verifies the packager as the author, and supposedly lets you and your system trust their contents.

But do you really trust your packagers? How could you? Do you know them personally and monitor their packaging work?

Would you even know if they release a package with malicious content?

@yisraeldov

Thank you! Keep in mind this is really still a pre-release. It's nowhere near feature complete (obviously), but I thought it's fun to give everyone the chance to join in and provide feedback as early as possible.

Updates rolling in on pretty much a daily basis right now 😊

@kaniini

The problem isn't the ID, but the pagination response also doesn't use integer values, but generated ID strings. I'm already preparing a PR for go-mastodon.

Hang tight.

@ben

@kaniini It's actually an issue in the upstream go-mastodon client, but I'm working on a pull request for it. Soon, real soon!

@KitsuneAlicia And I highly appreciate it! It's absolutely important to keep track of thsse things. Attention to detail is important. A constant feedback loop during development is an immensly useful tool to have. As such I'm really looking forward to seeing more tickets and feedback from you!

@KitsuneAlicia

Awesome! Just keep in mind we're still at a really early stage in development. It's not expected to be feature complete and there will be bugs... but never hesitate to open tickets!

In return you get the chance to watch a Mastodon client grow on a daily basis and you get to help shape it.

I hope more people find that intriguing and fun, otherwise I wouldn't have published it just yet 😆

@KitsuneAlicia That probably just means you don't have the qt5-xmlpatterns(-dev) package installed. The bindings for that particular library would be missing, but I don't think Telepathy depends on it in any way. It should probably still build fine. Let me know!

@zatnosk Will eventually clean that up, but it's nothing to worry about. It's initializing a delegate with an empty model, which simply lacks its members.

@brandon

I guess the avatar gave it away 😆

@Chuculate

You may have a point there.

@dustin

@emsenn

I guess that's possible, I must admit I didn't try that just now. But I'm very certain that pressing the test button does not indicate any battery level whatsoever: it always just fakes the same alarm sound.

@selea

@emsenn

I'm really confused now. That's not how any smoke detector works that I've ever seen.

You press the button, it fakes the alarm sound. No matter how full or empty the battery is: same sound.

Well, I guess unless it's completely empty, then it doesn't beep, but that's kinda expected 😆

@me

If I'd replace all the smoke alarms in this place with Nests, I'd probably first need to get a mortgage 😂

@emsenn

Then I guess I have literally the cheapest smoke detector out there, because mine definitely doesn't do that...