Mastodawn

Manuel Vacelet May 29

Laura

May 29

Manuel Vacelet May 28

Jordi Boggiano May 28

📦 Composer 2.10 is out today.

Native malware filtering, powered by an Aikido feed and enabled by default for everyone installing from Packagist. The new unified config.policy framework consolidates handling of malware, security advisories, and abandoned packages, and also lets organizations plug in their own custom policies.
Source fallback is now deprecated, and there's wildcard support in composer update --with.

https://blog.packagist.com/composer-2-10-release/

#php #phpc #composerphp

Composer 2.10 Release

We are excited to announce the release of Composer 2.10.0, introducing native malware filtering and consolidated future-proof customizable dependency policy configuration to control the handling of security advisories, abandoned packages, and now malware. Fast detection of malware for packages published on Packagist.org is provided by Aikido. This

Private Packagist

Manuel Vacelet May 18

kazé May 18

Bonjours, les nerds de #Grenoble ! Jeudi 28 mai, on fait #Apergol au P’tit Labo, en avant-première des #JdLL.

Y aura évidemment du #Quacken en test, mais aussi les touts premiers prototypes de #QMx2040 — donc si vous tapez en #AZERTY, #Bépo ou toute autre disposition de clavier moins bien que #Ergol ou #QwertyLafayette, votre avis nous intéressera vivement !

/cc @chouhartem @wizzro @birozularutti @TheyCallMeHacked @AnhkaaDNeige

#QuackMatrix #Poticlaviers

Manuel Vacelet May 11

Show thread

Trond Hjorteland May 11

Organisational Dysfunction of the Day

DORA, the wrong way round

Context: The DORA metrics have become the gold standard for measuring engineering performance. Deployment frequency, lead time for changes, change failure rate, and time to restore service. The four key metrics. Teams build dashboards around them, set quarterly targets, and run improvement initiatives to move the numbers in the right direction. Some teams genuinely improve, while others find the numbers are stubborn or that improvements one quarter quietly reverse the next. Leadership concludes that the teams need more discipline, better tooling, or another round of training. What gets called cargo culting (for lack of a better term) in the industry, copying the visible practices without the underlying conditions, is exactly this pattern.

OST explains: DORA was designed as a research instrument, not as a target system. The metrics are downstream signals of healthy delivery, not the drivers of it. Healthy delivery is when self-managing teams own the whole product, make decisions without escalation, and have tight feedback loops with the people they serve. Take those structural conditions away, and the numbers regress, no matter how many dashboards you build. Treating DORA as a goal in DP1 (bureaucratic) is exactly the goal displacement Goodhart warned about: the moment a measure becomes a target, it stops being a good measure. In DP2, the self-managing-group structure, the same numbers emerge naturally as side effects of work well done. You do not need to chase them. You need to build the conditions that produce them.

#OpenSystemsTheory #SocioTechnical #OrgDesign #DevOps