William Woodruff
-
Running for the Python Packaging Council
TL;DR: I’m announcing my candidacy for the inaugural Python Packaging Council. I hope you’ll honor me with your vote, if you’re a voting member of the PSF, but regardless I have high hopes (and expectations) for the council.
Published
-
GitHub Actions needs OIDC audience constraints
TL;DR: GitHub Actions should allow end-users to express audience constraints, to make it harder for an attacker to pivot across services that use independent OIDC-bearing jobs. They could do this with relatively small syntax tweak, although the backend implications are probably nontrivial.
Published
-
README, not
(Thanks to Facundo Tuesca for the name inspiration). If you’re like me, you spend a lot of your working day (and a good chunk of your personal time) reading code online. Increasingly, that means accidentally reading a lot of “slop”1. Personally, slop isn’t annoying per se2: it’s okay for personal software3…
Published
-
You shouldn’t trust Trusted Publishing
…because Trusted Publishing isn’t for you (or me) to trust! It’s for the machines.
Published
-
Registering my dissatisfaction with GitHub
Mini-post.
Published
-
Brocards for vulnerability triage
I spend some of my hobby time doing vulnerability triage on open source projects. As part of that, I see (and filter through) a lot of nonsense1. Spam, “beg bounty” submissions, and increasingly zero-effort LLM submissions. ↩
Published
-
Some flexibility with Go’s sumdb
I noticed this a year or two ago, but forgot to write it up back then.
Published
-
Dependency cooldowns, redux
See cooldowns.dev for up-to-date information on cooldown adoption across various languages and package ecosystems.
Published
-
We should all be using dependency cooldowns
See cooldowns.dev for up-to-date information on cooldown adoption across various languages and package ecosystems.
Published
-
Dear GitHub: no YAML anchors, please
TL;DR: for a very long time, GitHub Actions lacked support for YAML anchors.
Published