Hacker News: wallrat

New comment by wallrat in "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"

wallrat — Wed, 21 Oct 2026 20:15:19 +0000

Bytesafe (https://bytesafe.dev). Pure Dependency Firewall, not a package host, with usage based pricing.

New comment by wallrat in "Pnpm has a new setting to stave off supply chain attacks"

wallrat — Thu, 18 Sep 2025 09:30:48 +0000

There are a few commercial products that allow you to do this also for other ecosystems (e.g. maven, nuget, pypi etc), including ours https://docs.bytesafe.dev/policies/delay-upstream/

Good to see some OSS alternatives showing up!

New comment by wallrat in "We all dodged a bullet"

wallrat — Wed, 10 Sep 2025 08:23:12 +0000

There are dependency firewalls that let you enforce this (e.g. https://docs.bytesafe.dev/policies/delay-upstream/). Don't know any OSS solutions though.

New comment by wallrat in "OpenEoX to Standardize End-of-Life (EOL) and End-of-Support (EOS) Information"

wallrat — Mon, 12 May 2025 16:30:12 +0000

How does this relate to the OWASP/Ecma Common Lifecycle Enumeration Specification (https://tc54.org/cle/)?

New comment by wallrat in "How to harden GitHub Actions"

wallrat — Thu, 08 May 2025 14:04:20 +0000

Been tracking this project for a while https://github.com/chains-project/ghasum . It creates a verifiable checksum manifest for all actions - still in development but looks very promising.

Will be a good compliment to Github's Immutable Actions when they arrive.

New comment by wallrat in "JSX over the Wire"

wallrat — Tue, 15 Apr 2025 19:02:26 +0000

Very well written (as expected) argument for RSC. It's interesting to see the parallels with Inertia.js.

(a bit sad to see all the commenters that clearly haven't read the article though)

New comment by wallrat in "Turbo Pascal Turns 40"

wallrat — Fri, 01 Dec 2023 08:57:20 +0000

Still have the Turbo Pascal 1.0 manual on my shelf. It was the first language I picked up after Basic and QuickBasic as a child.

Wrote a couple of interesting things a few years later in TP 5.5, including a BBS/Kom system and a MUD (with 4 dial-in lines).

Found the source a few years back, was an interesting read a few decades later.

New comment by wallrat in "Python 3.12.0 from a supply chain security perspective"

wallrat — Thu, 05 Oct 2023 09:11:55 +0000

Is there any effort to integrate SLSA with PyPI? GitHub recently announced[1] that npm support for SLSA is GA now.

[1] https://github.blog/changelog/2023-09-26-npm-provenance-gene...

New comment by wallrat in "The Bogus CVE Problem"

wallrat — Fri, 22 Sep 2023 10:50:46 +0000

> Next step ist to establish good tooling around publishing VEX statements (Vulnerability Exploitability Exchange). That is currently not easy.

Agreed.

Tooling is needed for creating/publishing/consuming both VEX statements for applications (i.e. exploitability of a dependency in context), but also VEX statements from library authors (many times the actual experts, like the OP) as a way dispute the weakness/exploitability.

Currently working hard on this [1]. When the tooling is in place the next step for the industry will be discoverability of SBOM/VEX/VDR attestations. Sigstore/Rekor [2] looks to be a viable alternative here.

> Vulnerabilities are reported (using CPE, pURL etc.) at the "library" or "application" level but they really exist at a much more granular level (e.g. a single function is affected and if that's not used there's no problem).

Again, agreed. Reachability info needs to be commoditized, standardized and shared. The current situation where it's a feature used by vendors to compete is not ideal.

[1] <https://sbom.observer> [2] <https://www.sigstore.dev>

New comment by wallrat in "Ask HN: How to price your first enterprise customer?"

wallrat — Sat, 15 Jul 2023 14:35:39 +0000

The best kind of "problem" to have. Expect to build features, integrations and other customizations, and factor in the costs. You can do that with a higher "base" price, or include professional services into the contract (but be careful with IP rights). Use a per-seat model internally (more users = more support etc) and offer fixed price point per year. Expect to them to want to negotiate a large discount on the "list" price, so start higher than you might think.

New comment by wallrat in "NVD Damage Continued"

wallrat — Wed, 14 Jun 2023 08:04:39 +0000

DISCLOSURE: I'm working on commercial tooling for this exact problem [1]

> 1) What would your expectations be towards a software vendor in terms of what issues to "fix"?

I would want the vendor to communicate their analysis for all CVEs, i.e. letting us know which are exploitable or not, and what kind of response they are planning, or any fixes released.

There are efforts to standardize this workflow with Vulnerability Disclosure Reports (VDRs)[2] and Vulnerability Exploitability eXchange VEXs[3]. Both these use cases are covered by OWASP CycloneDx[4].

> 2) Is anyone aware of a security database & evaluation tool geared for vendors not for end-users?

IMHO, there are not any good tools available that solve the complete workflow. We are certainly aiming to fix that with[1], but it will take some time.

[1] https://sbom.observer

[2] https://www.cisa.gov/resources-tools/resources/minimum-requi...

[3] https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/f...

[4] https://cyclonedx.org/capabilities/vex/

Nezha: Deployable and High-Performance Consensus Using Synchronized Clocks

wallrat — Thu, 01 Jun 2023 08:57:22 +0000

Article URL: https://dl.acm.org/doi/abs/10.14778/3574245.3574250

Comments URL: https://news.ycombinator.com/item?id=36148852

Points: 2

# Comments: 0

New comment by wallrat in "An Intro to SBOMs"

wallrat — Tue, 25 Apr 2023 12:08:46 +0000

Interesting. Do you keep the SBOMs around after the build to track what's running in production?

New comment by wallrat in "An Intro to SBOMs"

wallrat — Tue, 25 Apr 2023 08:46:23 +0000

Are SBOMs a "thing" yet? Is anybody using SBOMs in their day to day workflows?

The current tooling for generating them seems to have matured, but tools for storing and managing an SBOM inventory seem non-existent with exception for OWASP Dependency-Track.

Filter risky NPM packages with a proxy

wallrat — Thu, 02 Feb 2023 20:03:27 +0000

Article URL: https://bytesafe.tech/strict

Comments URL: https://news.ycombinator.com/item?id=34632233

Points: 1

# Comments: 0

Zim caching build system for monorepos

wallrat — Wed, 01 Jun 2022 19:12:21 +0000

Article URL: https://github.com/fugue/zim

Comments URL: https://news.ycombinator.com/item?id=31586601

Points: 1

# Comments: 0

FaRM: Fast Remote Memory

wallrat — Wed, 23 Apr 2014 07:46:47 +0000

Article URL: http://research.microsoft.com/apps/pubs/default.aspx?id=208395

Comments URL: https://news.ycombinator.com/item?id=7632683

Points: 1

# Comments: 0

SimpleRedis - Ephemeral, instant. Free. Perfect for CI and development

wallrat — Mon, 01 Jul 2013 21:59:09 +0000

Article URL: http://simpleredis.com

Comments URL: https://news.ycombinator.com/item?id=5973858

Points: 1

# Comments: 0

New comment by wallrat in "Instant Server - Click the button to get a virtual private server"

wallrat — Wed, 12 Jun 2013 07:24:20 +0000

Interesting. http://simpleredis.com is a similar service, but for Redis instances (for testing, CI etc), including a nice console. Instances terminates after one hour, but you can run an instance forever if you validate your email.

Been thinking about doing the same for VPS, but using LXC instead (actually already using it for internally for running tests, CI etc).

New comment by wallrat in "Msgpack can't differentiate between raw binary data and text strings"

wallrat — Sat, 23 Feb 2013 12:49:56 +0000

Same here.

Last week it was needing Redis slaves to handle 'SLAVEOF NO ONE' from the master without crashing. Needed to tell all read-slaves (hundreds) to stop trying to reconnect when taking the master down.

It's fine balance though, you don't want to be stuck with too many forks to maintain.