I know the breadline well. Worked my way up from living in my car and eating out of trash cans. I do not personally know anyone who has come up from a lower place than me, and my advice remains constant because people are still the same even as technology evolves.

You can network at meetups, giving talks, trade shows, workshops, classes. Nothing converts higher than meeting people in person. That was true 20 years ago and may be even more true 20 years from now as human generated content on the internet drops to near zero.

Never build a business on hoping an algorithm someone else controls is nice to you.

Installing a .deb requires root. Okay, a coding agent that wants root access. I know almost no one is good at supply chain security unless it is their core business, 2500 companies hacked this week for using LiteLLM, etc. So I look around for source code links and come up empty.

So, I am supposed to just give a random binary on a website that may or may not be malware depending on what NPM dependencies are in play, and give it root access, and trust whatever unknown CI/CD system that builds it to be able to execute any commands on my system with root privileges, and I am not even allowed to review the code?

That is an amount of trust I would not even extend to family, and you are asking for it from every single user.

So I asked a local LLM to decompile it for me, the 198 dependencies, and license compliance.

From here I could have it write an extensive test suite, delete the code, have LLM re-write the code to pass all the tests, then open source the result myself.

I am probably not actually going to do this, but anyone could. Proprietary software is no longer a moat, and for something like this it just makes your software very hard to trust. Clean room code laundering is so easy now you might as well open source it yourself.

I called people, met people in person, sought out classified ads, made sure I was in the right parking lot at the right time to run into the right people.

I hustled to survive for most of my life, and I sure as hell did not need Zucks help to do it. In fact my web design clients were mostly small businesses that wanted to host their own websites to get them SEO and visibility that Facebook pages could not offer.

Again, everyone loves to make excuses for their dependence. I prefer independence.

Meanwhile I am looking at a Crush client running beside neovim in a herdr session I am accessing via ssh to a machine in my garage with 4 local GPUs. I think we Linux users have got this without Sams help.

If you have more than one author in the history though that won't work, but I imagine where this is used the most is by an author cleaning up their own PRs.

Appreciate being heard on this sort of thing! Will take a closer look.

The secret to making alternative platforms work, is actually engaging with them and pretending the toxic platforms you hate no longer exist.

I am a bay area serial founder, with no Twitter, Meta, Google, Apple, or any such other centralized surveillance capitalism bullshit. I do not even have a Signal account as centralization is fundamentally incompatible with freedom and privacy in my eyes. Never gets in my way of doing anything I want to do or talking to anyone I want to talk to.

People sure do like to make excuses on why they still -must- use those platforms even though they do not -want- to. Absolutely never let a platform hold you hostage. Let no one own you if you want freedom.

The smartest people I have ever interacted with are on platforms like IRC, Matrix, and Mastodon. I would rather build a social graph of thousands of people that also really value freedom over thousands of people that make excuses to stay trapped in walled gardens any day.

Signed git history is immutable, and unsigned git history is a supply chain attack vector.

That said I could see this being useful for single-author WIP branches doing cleanup before a PR

Look at my companies I work with via Distrust, and my resume. Most use stagex for their security critical operations, though I am unable to say which ones specifically. NDAs and all that. You could figure out a few of them if you looked.

I can tell you many many fortune 500 companies are relying on stagex for security critical use cases, and most are probably not even aware of it as they consume projects that wrap or build on stagex.

Some of us with mockery, and hopefully some with legal and political talent behind the scenes.

I am just a mascot pointing and laughing at a stupid unenforceable law with scary intentions. The real fight is likely to be fought by legal professionals, not me, and that is fine.

My job will be to keep shipping changes that protect user privacy and security because that is what my skillset is for.

They will be successful at forcing corporate operating systems like MacOS, Windows, and maybe RedHat, but they have no power to compel code being added to independent international volunteer maintained open source operating systems maintained.

For projects with no legal entity like Stagex, arch, alpine, etc... we do not have to comply and there is no legal mechanism that exists to make us. Who would you even target? All maintainers have equal power, and cannot make changes alone. Especially not changes we do not want, for free.

I think the legislators should PR age verification code to all open source operating systems on their own dime, so we can ridicule them mercilessly before closing them as WONTFIX.