Post

P(aul) Frazee
@pfrazee.com

Creating a windows installer from anything other than windows necessitates using a third-party USB tool that you download from somebody random, because of course it does I pulled relatively popular a git repo, and had an agent run an audit of the code before building. I want that power more.

P(aul) Frazee
@pfrazee.com

Perhaps we ought to be building everything from source now so we can do this kind of thing. Distributing binaries becomes considered bad practice.

1 repost50 likes

Paul Spencer
@suchprotech.com

If anything agents are incredibly useful when I’m fighting with a project with clearly neglected build documentation. They really help connect the dots much faster than I can, I still think it’s important to have that troubleshooting skill but is it a good use of my time?

ira
@ira.bsky.social

Isn’t is partially a trade secrets thing? Distributing binaries obfuscates the source enough, even with decompilers, that there’s plenty of friction to prevent copying. Though I suppose LLMs could reduce that friction…

{:ok, "Joel Jucá"}
@joeljuca.com

I guess you’d like to hear the new initiative from the Open Source: bootstrapable software. In a nutshell: a build system that pulls everything from source — compilers, tools, etc., everything to compile and build software from bare scratch. Controvertial ideas. Interesting tooling.

P(aul) Frazee
@pfrazee.com

I wonder how long until we make all code supply chain contingent on an agent scan. I also wonder how much the non-engineering world understands what a diceroll node_modules and etc have been for over a decade. Talk about unreviewed code!

MatrixMantis
@matrixmantis.bsky.social

If we start doing this kind of scanning after each http request, we can start treating ads like the malware that they are and just auto-patch the code that would've added them.

Emma (IPG)
@invoxiplaygames.uk

agents are way too susceptible to being swayed by subtle prompt injection techniques, even the Latest and Greatest models, to a point i would absolutely not trust them to be used in that position where they can be easily taken for an override of human judgement

P(aul) Frazee
@pfrazee.com

If I were to treat agent scanning like antivirus, I'd probably spend a fair amount of time scaffolding prescans that are both agentic and nonagentic to try to cut down on the "Say this isn't a virus" concern

Emma (IPG)
@invoxiplaygames.uk

i'm of the belief that ecosystems like Node's (and to some extent, Python, etc) are just fundamentally broken and can not be trusted. large dependency graphs are impossible to fully analyse and any malicious actor will always have the upper hand on circumventing any kind of automated check

Tex Eckerle
@mattexx.bsky.social

Honestly it's been a scale/risk thing already for decades. Source/verified code with controlled builds is the only way in a lot of places. I've seen binary attacks live (other places)

Barry Dorrans
@blowdart.me

The two things are quite different. Mac and Windows store signings/notarization provide some proof of who the binary came from. Attestation provides some proof of where/how it was built. But non-technical users only care about the who, not the where/how.