This is also interesting in terms of changing the economics of rewrites, esp. if doing so also forces you to document the things that might have been buried inside human heads.

Greenfield is cheap? Throw away old code as soon as it starts to rot and start from scratch!

By definition.

Who cares, we'll just have the AI tell us the code is good - why even run tests for it?

Imagine the pressure yer man is working under...

Not meta enough.

If you're a team lead, and your team starts emitting a lot more product (lets suppose it's not just "code", lets suppose it's actually "value") - how do you deal with _that_.

And probably, unfortunately, not just your country.

What's up with those fingers?

Folks would have seen a warning in sfw within minutes of the original publish, when automated scanning detected the potential malware and it was marked as “potential malware”. Further along in the malware campaign, human review was roughly happening in realtime, so sfw was blocking more quickly.

Use 2FA to publish.

every option, including "no 2FA at all", *can* be made secure. The problem is that it shouldn't even be POSSIBLE to publish insecurely - and either way, defaults matter.

OIDC and token-based publishing are default insecure, full stop.

We need them to enforce it on OIDC publish or turn OIDC publish off until it can be enforced, and to treat this with the urgency it needs.

I want to be able to stop having this discussion every other week and go into the new year without more supply chain incidents over the holidays.

It's times like these that I become a believer in LLMs overtaking humans in coding. Because the bar is really not that high...

Next thing you know, there will be legislation that bans well known patterns for matching secrets. You'll go to jail for using a regex. Against your own codebase to avoid leaking them.

> as in its current state it wouldn’t prevent attacks such as Shai-Hulud and other recent ones.

From our blog, almost like we knew. 🔮

openjsf.org/blog/publish...

I know 😁

Doesn't make his message less ominous if said in the right voice 😁

Sounds like a threat to me.

Did everyone fire all the UX designers in all the layoffs?..

Google's mantra in the good old days used to be "don't do things for SEO specifically, just produce good content with good structure, the bots will figure it out".

Whatever happened to good ideas like that?