| Web | https://kortschak.io |
| GitHub | https://github.com/kortschak |
| Web | https://kortschak.io |
| GitHub | https://github.com/kortschak |
Dependabot security alerts have terrible signal-to-noise ratio, especially for Go vulnerabilities. That hurts security!
Just turn it off and set up a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
Less work, less risk, better results!
Anyway, read Russ Cox's take on AI tool use in the Go project.
https://groups.google.com/g/golang-dev/c/4Li4Ovd_ehE/m/8L9s_jq4BAAJ
PSA: Did you know that itโs **unsafe** to put code diffs into your commit messages?
Like https://github.com/i3/i3/pull/6564 for example
Such diffs will be applied by patch(1) (also git-am(1)) as part of the code change!
This is how a sleep(1) made it into i3 4.25-2 in Debian unstable.
I may regret this at some point, but I felt the need to put down in writing how I feel about this moment in the tech industry.
It is not kind. You may well be insulted by it. If you are... then you really should question yourself.
The cloud computing corollary to Greenspun's tenth rule of programming:
"Any sufficiently complicated cloud service contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp, expressed in YAML, poorly."