[0] https://docs.github.com/en/actions/how-tos/secure-your-work/...

The advices here are really solid and actionable, and I would suggest any team to read them, and implement them if possible.

The scary part with supply chain security is that we are only as secure as our dependencies, and if the platform you’re using has non secure defaults, the efforts to secure the full chain are that much higher.

– Sunday at 3 a.m. for updates

– The prompt injection to skip CI

It was a fun read - I'm looking forward to it being ingested by future LLMs.

I didn't expect Google (Mandiant) to release rainbow tables ever. Curious what changed internally to make that acceptable now.

Would love to know.

So far that has been a great move, my terminal tab feel snappy again. One thing I miss (but I’m sure I could find a way to replace it) is `cd ….´

This is clearly a significant achievement, but does anyone with semiconductor experience have a sense of how far "generates EUV light" is from "production-ready tool"?

While down times are not ideal, that's quite an impressive achievement to be able to resolve an incident of this scale in minutes - not hours.

[0]: https://updog.ai/status/cloudflare

I wish Microsoft would invest more in improving it - especially since Sourcegraph can't search private repositories, leaving GitHub's tool as the only real option for many codebases.

Is there any recent event or broader trend that explains this shift?

As for Serbia itself: yes, it's not in the EU, but it's been in the accession process since 2012. The timeline is slow, but the country is economically integrated with Europe. If we're treating a Serbian office as inherently suspicious, that's a bar most of the tech industry wouldn't clear.

I’m not saying that won’t change but I still see a bright future for reversing tools, with or without AI sidekicks (like the BN plugin)

I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies.

[0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=259356

The Arch Wiki documentation will likely need updates [1], but sadly the list of non-compliant software is far too long.

[1]: https://wiki.archlinux.org/title/XDG_Base_Directory

I suspect this affects many developers who cut their teeth on PHP but haven't kept up. The language has become a different beast, which is a strength for the community but a barrier to re-entry.

Contributions to the documentation, translations, or helping managing the community are also extremely valuable and do not require the same technical skills.