raphinou.bsky.social

The CfP for the #security #devroom @fosdem.org was published: github.com/security-dev... . I will propose @asfaload.bsky.social as a talk, as it fits the #supplychainsecurity suggestion.

Here's a small improvement that required some significant work. It's similar to a TOCTTOU: signature happened in a second step leaving a small opportunity window open for an attacker. I also expect this change to make it much easier to add @gitlab.com support in the near future. #foss #security

Asfaload's talk proposal has been accepted by @cfgmgmtcamp.bsky.social! 2 years ago it was an in ignite talk of 5 minutes, now a 25 minutes intro to Asfaload. See you there! If you don't know it, cfgmgmtcamp takes place right after @fosdem.org #talk #security #softwaresupplychain

Just discovered that dioxus labs is joining cognition to work on an ai product, but also continuing to maintain dioxus #foss projects. Let's hope it is not detrimental to the foss projects. Seems their focus will now be on the ai product... dioxuslabs.com/blog/joining... #rustlang

Apparently an attack on refrigerators was possible because they were run by an 'obsolete' system, or at least labeled as such by the vendor. Will the @ec.europa.eu soon mandate open sourcing vendor-abandoned systems? How much more does it have to cost us before we refuse planned obsolescence? #foss

You know this little feature you want to add, which is supposed to be easily implemented, but which in the end requires you to rethink and refactor a part of your app? I just finished one. It ended in multiple days work and 60 commits! github.com/asfaload/asf... #development #story #experience

The venerable Tcl/Tk was released in version 9.1: www.tcl-lang.org/software/tcl... I might try to build a #gui with it over the @asfaload.bsky.social #CLI, following the idea at cgicoffee.com/blog/2026/04... #release #scripting

The next review in our #FreeYourAndroid series on #Android distributions is about #iodéOS from iode . iodéOS is based on #LineageOS and comes with a built-in network blocker, call spam blocker, and parental controls. How does it fit your daily life? Go check it out! 🚀 fsfe.org/activities/a...

When will institutions like @ec.europa.eu strictly enforce the use of open standards? And no, you can't pretend to promote open standards if you use Microsoft Office: www.neowin.net/news/libreof... #foss #standards #office

You often hear that commercial software is used in enterprises for the support they get. Well, thanks Broadcom for giving the perfect counter example: www.virtualizationhowto.com/2026/09/leav... With #foss you cannot be taken hostage by the provider.With commercial software,the risk is always there.

Switzerland's federal government replacing ms365 with #foss on 3000 PCs in a first step: itsfoss.com/news/switzer... Yesterday I was thinking about getaurora.dev/en/, an immutable #linux distro, as an interesting option for SMEs with its atomic updates. Let's hope replacing the OS is the next step.

Avoid online identity verification that scan your documents. If your discomfort regarding the practice is not sufficient, here are examples of data breaches that should be: www.techdirt.com/2026/09/03/h... and krebsonsecurity.com/2026/09/fbi-... #security #identityyheft

For @asfaload.bsky.social I chose ed25519 signatures for its pervasive use. However, there's one place it is not common: the TPM in PCs... Why? 😫 #security #cryptography

Tried to activate #passkey for my Google account using #firefox and #bitwarden. It was a traumatic experience.... I don't even know how to explain how it took so much time for so little result... @arstechnica.com has more prose about passkeys: arstechnica.com/security/202...

accessing the /e/ os install page at e.foundation/installer/ with @mozilla.org 's Firefox on Android proposes proprietary browsers alternatives.... A welcome page explaining alternative installation procedures would probably be better.

A collaborative #slideshow solution in one html file! Edition and presentation. And #opensource ! github.com/nyblnet/bento #foss

One team? Not mine! @fightchatcontrol.bsky.social

An (online) open source license compatibility checker: fossa.com/resources/de... #foss #license #legal

Note to self: in #rustlang, you convert an Option<String> in a Option<&String> with the method as_ref, and for the conversion Option<String> to Option<&str>, use as_deref. Damn, I have a hard time memorising these method names. Same for Option::ok_or. Absolutely not intuitive to me.

If you want to help bumblebees, this is a tree they love: en.wikipedia.org/wiki/Vitex_a...

If you hear someone say @microsoft.com loves #opensource, point them to this report: research.mozilla.org/browser-comp...

I'm a fan and user of #docker #swarm. Such a pity it didn't get traction. Most of us don't need google-scale tech and the #k8s complexity it brings... As swarm is just barely alive, this seemed promising: uncloud.run But: allowing all containers to contact all others?☹️Too easy to shoot in one's foot

#LLMs are what allowed me to keep myowndb.com up to date. It is a #foss #fsharp project with 1500+ human-authored commits that lost my focus. I would have archived it. Now I plan to continue to #BuildInPublic . Disclaimer: the project has exhaustive tests and llms were used as assistive technology.

The #ascii representation of a #ssh key is based on an astonishingly simple #algorithm. Read the simple idea at www.jfurness.uk/the-drunken-... and the full #paper at dirk-loss.de/sshvis/drunk... So simple I'll probably implement it for @asfaload.bsky.social for easy hash comparison when signing

A sudo replacement in systemd: fosspost.org/systemd-want... RIP Unix philosophy. As an alternative, did anyone try Root As Role? github.com/LeChatP/Root... #linux #security #foss

Cool to see myowndb.com mentioned in @sergeytihon.com 's #fsharp weekly. I deployed an updated version this morning, now using websharper 9. Next step is DotNet 10 then websharper 10.

Good progress this weekend on myowndb.com upgrades and @asfaload.bsky.social documentation, incl a tutorial video! #foss #fsharp #rustlang #buildinpublic

A new version of myowdb.com has been deployed. There's no new feature, but it's part of its upgrade to the latest versions of DotNet and websharper. #dotnet #fsharp #buildinpublic #foss Code at gitlab.com/myowndb/myow...

After Lima yesterday, another interesting #foss solution to easily run #vm and #container: smolmachines.com It's also #crossplatform

lima-vm.io Looks interesting to easily start vms and containers in them. #linux #virtualisation

A release action not only for GitHub but also gitlab and gitea, however supporting only #rustlang : github.com/release-plz/... Also publishes to crates.io 🎉 Bookmarking to switch @asfaload.bsky.social repos to it

Just saw rivet actors are in beta for #rustlang : rivet.dev/docs/actors/... I'm happy with github.com/tqwewe/kameo in @asfaload.bsky.social , but I'm curious about rivet's durable state feature.

I quite like the content about #async #rustlang at aibodh.com/books/the-im... That's an advantage I enjoy now I'm using a popular ecosystem. I like #fsharp very much, but the amount of content published about it is much smaller (though often of high quality too)

Just wrote an #apache #httpd rewrite rule for the first time in years. /doc -> /docs . Required multiple attempts while I would have done it with closed eyes years ago. How things have changed from when apache was on top (for 20 years!): www.netcraft.com/blog/june-20... #sysadmin #http

So long for #eu #digital #sovereignty : waag.org/en/article/e...

The best #spam calls blocker for #android had a release yesterday: github.com/aj3423/SpamB... #foss

Impressive the progress we've seen in #foss solutions. I've been able to produce video tutorials using only Foss: GNU/Linux distro, #obs for recording, #kdenlive for editing, #peertube for hosting

Published a first demo of our CLI. Covers generating keypairs and reusing ssh keys (yes, asfaload lets you sign your artifact using ssh keys!).Required some tweaks to find the good settings to keep it readable, but looks ok now!See here: www.asfaload.com/videos/#mana... #obs #kdenlive #buildinpublic

Just discovered these high quality videos teaching #rustlang by @rustcurious.com : rustcurious.com . I've recently been working on short videos for @asfaload.bsky.social and it's been taking so much time to produce my 4mins video, I'm really impressed by the 40 mins videos! Go check it out!

Published a small intro #video about Asfaload completely produced with #foss: Marp markdown slides, #obs studio recording, #kdenlive editing, #peertube serving. I have embedded it in the homepage at www.asfaload.com

When I introduce someone to Asfaload's solution, I noticed the discussion often follows the same script. That led me to write it down in a post. Take look if you want to understand what Asfaload does and how: www.asfaload.com/blog/asfaloa... #buildinpublic #security #softwaresupplychain

First marketing material for asfaload! "Self-made"(using an LLM). Not a perfect design, but sufficient for now! #buildinpublic

Deployed client howtos at www.asfaload.com/doc/client-c... . Now with demos recorded with github.com/charmbracele... Here's an example for generating a new keypair: #security #buildinpublic #supplychain

One more #breach that @asfaload.bsky.social prevents: www.neowin.net/news/if-you-... Our #opensource #multisig solution is auditable and can be #selfhosted. Check info at asfaload.com Available very soon! #security #softwaresupplychain #jdownloader @neowindy.bsky.social #buildinpublic

Deployed backend for the first time,and ran an e2e test script on it successfully.It registered a #github project,registered a release' assets, collected signatures from devs,and made a download of the asset, checking signatures.Happy with the progress! #buildinpublic #security #softwaresupplychain

A #git #performance #book . Working on @asfaload.bsky.social which stores its data in a git repo to make it auditable, that book looks like a great resource!

I read @filippo.abyssdomain.expert 's post about quantum comp's timeline[1]. Raising questions for @asfaload.bsky.social, a multisig file auth solution, using ed25519 sigs, allowing ssh keys use. But no quantum resistance! So:pqc resist 4 later or convenience now?🤔 1: words.filippo.io/crqc-timeline/

Asfaload can now use your ed25519 ssh keys to sign artifacts! No additional key to manage for Asfaload.

I will probably use the #linux kernel's policy on #ai coding #agents in my projects like @asfaload.bsky.social . In short, add a "Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]" tag to the commits. Humans commit and take responsabilities, but agent use is traced.