I’ve stopped using stash and mostly just commit to my working branch. I can squah that commit away if I want later. But we squash before merge so it doesn’t tend to be worth it.

It’s just less things to remember.

I’m just a hacker. I’ll never be a thought leader. But I am passionate about my work. And my kids.

I love solving the problems. I have a few posts on the company blog but they put a chat bot on it a while back and didn’t care that it felt offensive to me.

But I’m here, reading this. Maybe I’m grey matter.

I feel lucky to have avoided this so far. It’s really not like this on my team. I write a fair bit of code and review a ton of code.

It’s cute. Maybe my favorite use of ai I’ve seen in a while.

I wish it looked at contributions instead of just the profile page. Much more accurate roasting.

Mine looks a little like that. It’s my job though. Everything’s on GitHub.

I think the technologies are pretty bubble based. We are 80/15/5 Mac/Linux/Windows and it’s been 15 years since I worked on a software team that’s thats mostly windows. But I talk to them from time to time. But if anything Mac feels underrepresented compared to my bubble.

I admit I’m probably biased in favor of believing the survey is representative. I work on one of the databases.

Speaking of databases, I don’t work on SQL Server but can see the appeal. It implements a huge array of features and it’s documentation is pretty good. Folks have told me it’s a lovely database to use.

Good for them!

Yeah! Like that!

Usually I use glob patterns for test selection.

But I did use reges yesterday to find something else. A java security file definition.

I dunno about stdx as a solution. It’s just not a big enough list.

At work we build a big java thing and we:

• Manually import all dependencies, including transitive dependencies.
• Bless them by committing their hash to our repo. I think the cargo lock file does something similar.
• Audit the dependencies by hand. Sometimes that’s reading them all and sometimes thats less. Honestly, it’s often less. A few times it’s being members of the upstream community.
• Don’t allow running as root
• Drop all permissions we don’t need with seccomp including reading a bunch of stuff
• Sandbox each thread based on what’s on the stack. Untrusted code can do less stuff.

It’s still not enough. But it helps.

Maybe a web of trust for audited dependencies would help. This version of this repo under this hash. I could see stdx stuff being covered by the rust core folks and I’m sure some folks would pay for bigger webs. We pay employees to audit dependencies. Sharing that cost via a trusted third party or foundation or something feels eminently corporate. Maybe even possible.

Thanks. I remember one of these had people being excited about it and I felt bad that I couldn’t try it. But Linux is hard and we are all so grumpy. I get it.

Is that the Mac only one?

We can be heretics together. But you’re wrong. It was the best of the three because it commented on the universe.

I wanted to love TFA. So much promise wasted by repetition. They had an es-storm trooper! A super emotionally damaged Vader worshipping anger Jedi. The wiggly light saber. I should have loved it. The characters were so cool. But they didn’t do anything new. Felt very design by committee.

In TLJ the characters did new things. It didn’t all feel right to me. But it was new. I loved Luke’s story. War stories should leave their heros damaged. I loved the worthless dirtfarmer parents. Everyone can’t have special parents. Even Poe’s stupid story with pink hair general was a commentary on how ruthless rebels have to be. People die. You can’t waste resources. There was a lot wrong about TLJ but it tried.

And ROS had one good line. That’s it.

The actors deserved so much better. They worked hard. They loved star wars. They wanted to make something good.

Do folks still use logstash here? Filebeat and ES gets you pretty far. I’ve never been deep in ops land though.

The point of the license combination they use is to allow the enterprise version to be open and live in the same repo as everything else. Dunno if that’s what they do, but that’s why the elastic license exists.

The only surefire way is to read it all. And understand it all. That ain’t happening though. So you decide how much to do.

You should figure out how many people are landing patches and get a rough sense of why. Same for folks filing issues or talking about the project in general. Maybe you trust one of the contributors for some reason. Either way, you want to know how alive the project is.

You could land a patch.

You could spot check parts of the code.

You could run vulnerability scanners on it.

I dunno. It’s hard.

I’m not sure I’d attach any meaning to real names online. There’s a whole group of us whose online names are just things they thought were neat when they were 12. And they’ve just stuck forever. There’s lot of reasons.

But otherwise, yeah. I’ll spend ten minutes looking up someone’s online profile. Mostly for GitHub if I can find it. If someone’s commenting on public prs and seems nice that’s a big signal.

I agree. Light touch until you have a bunch of changes landed.

I was a professional open source contributor for a while. Still have the same job, but the license changed. Culture still quite similar though.

We squash. I’m not really interesting in your local journey to land the change. It’s sometimes useful during review, but after that it’s mostly the state of the main branch I care about. It’s what I need to bisect anyway.

I don’t like commits that are just references to issues. Copy the issue into the commit message so git blame tells you something useful. Unless it’s just closing a simple big. Then the title and issue reference are plenty.

Depends on the project I imagine.

I wonder what my last commit at each job was. I’ll bet it was boring. About 10% of my commit messages are genuinely interesting.