nevon

To prevent impersonation and having people download potential malware from repositories posing as the official xscreensaver distribution channel.

I feel like this is a bit of a "draw the rest of the owl" problem. With a couple of terabytes of logs per day, god knows how many metric timeseries, thousands of cloud environments, thousands of repositories, hundreds of thousands of build pipelines running every day, it's not something you can just point an agent at and call it a day. Segmenting and correlating the data is _hard_. Even something as seemingly simple as "p95 latency of this endpoint has increased - what repo contains the responsible code" is difficult to do, even if you are willing to give an agent read access to everything.

In Sweden, we have a meme that goes something like "It doesn't matter if it's untrue, it's still outrageous".

Essentially, you are complaining about something that is simply not the case. As you yourself said, this isn't Tor preventing free speech. This is Tor evaluating their commercial partnerships based on their values and whether or not they are compatible with the speech of their partners. So, it has nothing to do with Tor's stance on or facilitation of free speech. Therefore, there is nothing to be outraged about.

I would say the Swedish Democrats are the AfD of Sweden, and Örebropartiet is the more extreme variant, but otherwise of the same ilk.

Not sure how you got to that determination from reading that comment. Perhaps you should educate yourself on the subject matter before making such statements.

I am Swedish and understand the relationship between our government and the various agencies. Elected people make laws to direct the agencies, and the agencies implement said directives.

I did the same with another project that does the same thing, called ck, and wasn't able to wring out any improved performance over just plain grep.

Having seen this happening in the past, pre-AI, the answer is usually that they don't. They just stay on that version forever. Or it's maintained until the original author moves on, after which it's someone else's problem to figure out how to move back to the upstream, which has now had years of changes.

This is how I'm doing it as well, for an internal enterprise platform for agentic workflows. Let's me implement as fine-grained access rules as I want, and gives me somewhere that can hold credentials without exposing them to the agent.

Yes! Few things piss me off more. It boggles the mind that this behavior is the norm, and it happens all the time! There are practically 0 situations in which I want something to automatically steal focus.

That seems to be a new game. Backyard Baseball '97 is listed at around $10

To my knowledge, there isn't a single definition of a union. In America, it seems to mean something wildly different than what I'm used to in my part of Europe.

To me, it is simply an organization by workers to collectively bargain with capital (who have their own equivalent to unions). The unions also typically offer unemployment insurance as well as income replacement in case of strikes, which are a possible measure that can be organized by the unions to force capital to come to the negotiation table. An employer has no right to know if you're in a union or not, so it would be quite impractical to try to hire only non-union members, and most companies don't mind either way, because the collective bargain agreements go both ways and can make it simpler than negotiating individual agreements with each employee.

In the US, it seems like unions are what I would call a guild - very highly coupled to a particular profession. Where I'm from they typically accept anyone who works in a general sector (say medical, government, transportation, etc.), as typically most workers in the same sector would have similar challenges and goals.

I did the same, except I'm paying for Mullvad through the Tailscale partnership, so I reached out to them and expressed my desire for them to partner with other privacy focused VPN providers like Njalla, Airvpn and others. I don't feel great about my money funding ethno-fascists in my country.

Firecracker launches small, but otherwise general purpose virtual machines. Containers, at least the standard implementations that most of us use, use kernel features like namespaces to isolate workloads, but still share a kernel so the sandboxing is not as strong.

Wasm is a virtual machine, just like for example the jvm is, that is designed around only allowing the executed program access to the host runtime via specific apis that are subject to security policies. It does not run arbitrary software, but rather only software built to target specifically wasm.

The software this post is about is just bundling a wasm runtime with other software for convenience.

Anyone have ideas about what to do when using cgroup weights rather than max?

I'm currently in the process of removing cpu.max from our clusters, to allow applications to better utilize the available cpu time which currently is just being wasted. We will use cpu weights to make sure that cpu time is fairly allocated during contention, and to not oversubscribe the hosts, but I'm sure that among the thousands of applications that are running on those clusters today, many will be relying on cpu.max to size threadpools etc.

On the one hand, we do want applications to use the available cpu time, but at the same time they need to not kill themselves by running out of memory.

Network policies controlling egress would be one thing. I haven't seen how you make secrets available to the agent, but I would imagine you would need to proxy calls through a mitm proxy to replace tokens with real secrets, or some other way to make sure the agent cannot access the secrets themselves. Specifically for an agent that works with code, I could imagine being able to run docker-in-docker will probably be requested at some point, which means you'll need gvisor or something.