Hacker Newsnew | past | comments | ask | show | jobs | submit | more decodebytes's commentslogin

https://www.stacklok.com/careers

Stacklok is a startup focused on software supply chain security, founded by the co-founder of kubernetes and myself (Luke Hinds, founder of sigstore)

We are also look for a staff data scientist and a senior / staff SRE, but don't have the roles up just yet. You can reach me on luke@stacklok.com , but no recruiters (you will end up in the blocked folder).


https://stacklok.com/careers

stacklok is a series A round startup in the supply chain security space, co-founded by the founders of kubernetes and sigstore.

Currently seeking mostly engineering roles. front end (react) and backend (go / gprc).

This is full time remote, but only hiring from EMEA to the East Coast of the US.


How much Cycling do you have to do for that to become a credible risk though? I am imaging quite a bit more than a daily commute.


Cycling doesn't directly cause loss of bone mineral density. Ride as much as you like.

The issue is that some people use cycling as their only form of exercise. For bone health you need to mix in other high impact exercises such as running and weightlifting.


paranoid and false.

The Root CA is generated by the sigstore community (five folks, two from academia). Right now github exchanges an OIDC token for a sigstore root chained cert.

GitLab are currently adding themselves, to have the same capability (several other providers are there as well).

https://github.com/sigstore/fulcio/pull/1097


Yeah, we'll see. You say paranoid, I say extinguish.


Extinguish what exactly? Are people publishing packages to anywhere other than npm, and maybe GitHub? Microsoft already owns both of those, so there is nothing to extinguish.

It's not clear what you're worried about, and I'm skeptical you can articulate it, because it makes no sense.

And I say this as someone who is an extremely paranoid anti-corporate crusader, just like I imagine you are. But in this instance, your worry is misplaced.


My thinking is that the path goes thus:

- build on the record of supply chain compromises in npm to justify a provenance system

- establish yourself as one of the trusted authorities on establishing provenance

- spread fear and doubt about untrusted software

- become the trusted source and supplier of software

- open source becomes synonymous with untrusted software, basically malware

- in microsoft we trust

I think microsoft's land grab over open source software was pretty clearly established when they bought github and the general attitude of "they're nice now, it'll be fine" is going to be judged harshly in the future. Or I'm a paranoid crank with a misplaced mistrust of microsoft, who didn't declare "linux is a cancer" or anything like that.


I understand that line of thinking, but what land are they grabbing? They already possess all of it through npm and GitHub.

Do you think they intend to exclude caches like yarnpkg.com as insecure? I don't see how they would do that, since (1) your cache is a local config variable, not part of package.json, so there's no static analysis that could mark packages downloaded through Yarn as insecure, and (2) all of the key signature metadata is publicly available, so any cache or alternative package manager can implement the same provenance features as npm.

Or are you worried about EEE of the upstream source repositories and CI runners, eg "only packages built through GHA platform can contribute provenance data to npm registry?" I guess I could see that as a more reasonable fear, but as someone else explained to you, it's also unfounded (at least for now - which is maybe your argument), and GitLab is currently working on their own implementation. But even if they tried that, then you could still publish and consume packages from another registry if you wanted to. And I'd like to think that if Microsoft made a hostile move like that, we could count on package managers like yarn to pull provenance data from other sources.


better overview on the main release blog: https://github.blog/2023-04-19-introducing-npm-package-prove...


Yes, and second analysis by an independent party: https://socket.dev/blog/npm-provenance


> I changed my diet and began exercising. Lost 50 pounds. My sleep apnea went away and I no longer even snore.

That's because you have OSA (obstructive sleep apnea). I (OP) have central sleep apnea, there is no obstruction, its related to the nervous system. I am already very lean (I run ultra marathons as a hobby).


OP here. I purchased the first device privately from resmed (one of the main cpap vendors), but the actual one i needed was an ASV and this was refused privately and only available via the NHS. Reading between the lines, I expect the NHS is one of their main customers and had ordered a huge backlog, so they got priority.


I would love to see an open-source and open-hardware project for an ASV...

Moreover it could easily be coupled with the sensors and soft required to work as a sleep analyzer, in order to help diagnose central apnea vs obstructive apnea, etc.


I commented on this above but I think this is because ASV users need to be screened for heart issues first!


I do wonder how many left 100% of funds in there?


Its a risk many did not consider. Garry Tan says 30% of YC companies.


Is this is the source of that 30% number?

> 30% of YC companies exposed through SVB can’t make payroll in the next 30 days.

https://twitter.com/garrytan/status/1634286688922132481?s=20


This is what boggles my mind. How did they not consider and hedge against this risk? Why did their advisors not raise an alarm about this?


Someone wasn't doing their job


I honestly expect their will be an acquisition on Monday, with a lot of executive (whitehouse) pressure behind it. So much of the American economy is based on a tech advantage as is its national security. I could of course be completely wrong.


That is only if they want to keep the company operating? I


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: