Hacker News Reader

bureadoon Show HN: Scan your AI agents for dangerous capabilities

The user separation isn’t even necessary, as far as I’ve seen in the projects in https://github.com/bureado/awesome-agent-runtime-security

bureadoon Self-hosted dev sandboxes with preview URLs (Docker, Go, no K8s)

hth: https://github.com/bureado/awesome-agent-runtime-security

bureadoon Linux is Most Used OS in Microsoft Azure – over 50 percent of VM cores

This Xbox service runs on Kubernetes: https://azure.microsoft.com/en-us/blog/building-xbox-game-st... (I work on Azure, focusing on Linux and open source technologies)

bureadoon Long-Term Future Fund: August 2019 Grant Recommendations

While long and at times disjointed, I found this a refreshingly transparent report on something that feels half counterintuitive (scattered grants in the context of effective altruism) but that I can relate to as I research open source sustainability challenges.

bureadoon Ask HN: What are the signs that you have a great manager?

In a larger organizational setting, your manager probably has a title that reflects their level and/or seniority, such as principal or general manager. Or at the very least they'll have something in their business card, like product manager of foo.

When you talk to your manager, are you consciously aware of their title? Do they speak to you with that clout? Do you filter what you say based on that?

bureadoon Microsoft CEO Satya Nadella Comes to Red Hat Summit

Where is this coming from? I was the one organizing this sponsorship.

bureadoon Leaderless Debian

Chris Lamb is a remarkably active and outgoing DPL. But yes, I've been active in Debian for well over a decade and I've seen both a lot of people leave and new people that I don't know or get to know as I used to. All 5 DPL candidates ring a bell for me, though.

bureadoon Leaderless Debian

In alternatives, packages write their files to the disk and then register those as alternatives. A user can decide which one should satisfy the alternative.

In diversions, a package claims a file. When anyone else tries to overwrite the same file, it's diverted elsewhere. It isn't designed for the user to choose between equals.

I built a derivative distro using diversions mainly to prevent "soft-forking" Debian packages as much as possible (maintaining packages is extremely costly for anyone that isn't a decentralized organization like Debian)

bureadoon Leaderless Debian

RPM-based distros certainly led server OEM shipments back in the day, but that didn't mean Debian wasn't being used extensively in the backoffice.

As others have pointed out, APT played a critical role in Debian's popularity as open source software grew and early naive software distribution methods were outpaced by complexity.

I won't weigh in on Canonical's broader presence across verticals, technologies, etc., but Ubuntu is widely recognized as the most popular Linux in cloud platforms. I believe this is a direct result of APT coupled with a more rapid release pace.

RPM-based distros remain extremely valuable and extremely popular in many scenarios, particularly when someone has to run a product from a proprietary ISV or something that has a very complicated certification model.

In some cases, but certainly not all and in my opinion in a decreasing amount, the choice of distro might be tied to how active a particular company is in the upstream kernel. "Buy Red Hat because they contribute to the kernel". Suffice to say as decision makers perceive that their app isn't the kernel, that decision criteria is shifting (thankfully, many RPM-based vendors including Red Hat have many other value items to add)

bureadoon FOSDEM is a free event for software developers to meet

If you attended FOSDEM 2019 and live anywhere in the Americas, I would love to get in touch to see if we can organize an Americas FOSDEM Debrief with a handful of people in the room plus live streaming. It'd be great to have summaries per track. It'd be fantastic to have speakers join us, but I'm mostly interested in attendees. I'm same username on Twitter, too.

bureadoon FOSDEM is a free event for software developers to meet

It was my first time at FOSDEM. I listened to podcasts/read blog posts from people that have been attending the last 15 editions so I kind of knew what to expect. I brought snacks both days, and didn't bother bringing a laptop. I picked odd hours for commuting, and tried to commit to a track/room for a bit (it took me days to figure out my schedule)

That means I probably missed some of the FOSDEM experience but I also didn't experience much crazy (except for the wintry mix that made moving around so hard on Saturday)

You are right that the volunteer experience is inconsistent and I have no data to compare to other years. At times, in some rooms, it felt like the attendees were self-policing (shooshing others, controlling people standing up, etc.) when the volunteers were not. I've also been to events in other places (Open Source Summit Japan comes to mind) where there were volunteers but the experience was much more streamlined. It might be cultural, who knows.

What I heard (and therefore wasn't expecting) is that nothing new gets announced at FOSDEM anymore. However there are still tens of thousands of people in the industry that might hear the news on Twitter/HN/elsewhere and still want to go ask questions/have a debate.

bureadoon FOSDEM is a free event for software developers to meet

What do you mean by "commercial, in your face"?

I mostly attend open source/tech conferences in the Americas. I think I know what you mean, but that's not the main difference I see between FOSDEM and those conferences.

There's still "commercial" at FOSDEM (plenty of sales pitches in sessions, to begin with) but I think what's strikingly different is that FOSDEM has no "agenda", that is, the event isn't crafted around a theme and said theme doesn't dictate the rest of the content and the discussion.

bureadoon Let’s talk about open-source sustainability

The sustainability of your project, or the sustainability of open source?

I don't mean any disrespect, I'm genuinely trying to get to the bottom of the concerns around funding. There's no lack of funding mechanisms for open source (see oss.fund) and certainly no lack of money flowing into open source (see COSSCI) but arguably the 30M+ developers on GitHub don't see much of that.

The argument I often see floating around is that this isn't a new problem, there's just more of us and more money and from a different source this time around (VC) and yet open source has been "sustained" as a model.

bureadoon Let’s talk about open-source sustainability

Yeah. Science has a (some would argue) slightly more sophisticated approach to bounties in the form of grants. The inconvenient part is that many things ending in "Foundation" in open source have no resemblance to things like the NSF.

bureadoon Microsoft’s failed attempt on Debian packaging

Maintainer scripts are still very valuable, we use those in other packages (such as Code) for update-alternatives and they can be really useful in APT-based systems for user prompts via debconf. But, at any rate, we weren't thoughtful (at all) on what we did with those scripts. The team addressed that earlier today, using maintainer scripts: https://aka.ms/Oxbegy

bureadoon Microsoft’s failed attempt on Debian packaging

They will eventually fix it up as opposed to...

The team released a new package a few hours ago after talking to not only others at MSFT working with Debian and Linux but especially norbusan (OP): https://aka.ms/Oxbegy

I personally spent just a few hours of the last day with the team but I think our packaging practices are coming out stronger from this. At the very least I think this team is approaching debconf and dpkg-divert and update-alternatives (and the portions of those concepts that can translate to RPM) in a much more thoughtful way. I'm sure that was also what OP intended.

(Disclaimer: MSFT employee, just in case.)

bureadoon Ask HN: Who is hiring? (March 2017)

Microsoft | Product Marketing Manager | Seattle | ONSITE https://aka.ms/m0f72a

Our team of open source change agents in Azure is growing! We thrive when organizations of all types transform what they do with open source in the cloud, whether Linux, Node.js, Docker, Java or other open source technologies.

If you're looking to do something different where you can still bring deep subject matter expertise in the open source space, don't hesitate to get in touch.

I am not the hiring manager but I'm part of the team and have done open source here for 7 years (one of the few Debian Developers around, if you share our love for debian/rules)

Drop us an e-mail: opensource@microsoft.com

bureadoon Sandstorm is returning to its community roots

I read the article and my key takeaway was that licensing was a significant culprit. But Parse and Sandstorm are different. Do you think there is something systematic to open source or to VC-backed startups or to developer tools or something else?

bureadoon Sandstorm is returning to its community roots

The consulting model was decent 10 years ago but it's lousy today. It will come back in 5 years or so but as a model it isn't very different than non-open source professional services. So the question is how does open source advance in the face of these cycles and I think your point is that even if some folks can make some marginal profit at a particular point in time due to the way money flows in open source, the ecosystem doesn't advance much as the project governance is tied to the whims of the consulting business.

bureadoon Increasing Attacker Cost Using Immutable Infrastructure

I remember when mounting /tmp noexec and chmod g-w on htdocs was enough.

bureadoon Announcing SQL Server on Linux

Scroll down on this page for more information on client drivers: https://www.microsoft.com/en-us/server-cloud/sql-server-on-l...