taleodor
Joined 8 years ago
Karma
159
Submissions
175
Member since
Jun 2
Building ReARM: Release Governance Platform - rearmhq.com
View on Hacker NewsRecent submissions
Comment · 2 months ago
Check ReARM we're building for durable tracking of releases, software updates and fulfilling 10+ years obligations - https://rearmhq.com
Comment · 3 months ago
Small and cheap cloud VM, preferably on a separate account used for this purpose specifically.
Comment · 3 months ago
This is more about understanding the big picture and architecture of what's going on (the part about the diagrams / blueprints). One practical thing actually that may be useful to you - try thinking and testing in terms of "what can go wrong" rather than "is this prod-ready".
Comment · 3 months ago
If you're planning to put it into production anything you do outside of bringing somebody qualified at this point is likely a waste of time. Highly recommend this recent talk by Kelsey Hightower on the subject - https://www.youtube.com/watch?v=A7WFt2JQ5sg
Comment · 3 months ago
Full CRA requirements kick in in December 2027. Reporting obligations kick in in September 2026. Would probably make sense to update the website timer to reflect December 2027 deadline which is more relevant here.
Comment · 3 months ago
Did you try working with CycloneDX AI/ML BOM group? This would be good place to contribute.
Comment · 3 months ago
We support this with ReARM - https://rearmhq.com/
It's an open-core product (there is an option to self-host FOSS ReARM CE yourself) that gives you per-release vulnerability posture. It consumes various artifacts (e.g., SBOMs) generated during CI phase and does scan on them, doesn't need access to source code. Apart from SBOMs it consumes files with findings from other tools (reports in SARIF format, VDRs, VEXs).
Comment · 4 months ago
Very cool, we're doing similar except we let agents open PRs as well + we track release metadata and agentic sessions via our ReARM system + we've recently launched an option for agents to track helm-based deployments via ReARM - https://docs.rearmhq.com/workflows/devops.html
Comment · 4 months ago
It's not about that we should drop LLM completely from the mix, but something like AI -> LLM control -> old-school classifier control -> script / human oversight is the way. If something has potential to cause millions in damages, it should be subjected to human oversight (likelihood / impact analysis needs to happen early in the system design).