Thomas Depierre

SRE. Elixir Dev. Learner in Resiliency. French.
All Opinions are my own. And i have a lot.

Co-Founder and President Haruspex.dev

dom. He/him.

Blog: Softwaremaxims.com

Last Notes

2026-08-23 12:54:26 GMT

- reply

@nprofile…az86 Here is my pov as a maintainer.
I agree with a lot of your options, but I think they will take a long time to actually hit. Because shipping continuously is going to need massive rethink at the org level, and the kind of defense in depth you recommend mostly need OS level capabilities and better build tools, which is at best a decade way from prod, in reality probably more.
But there is something else
I don't think the threat level for anyone is actually higher than before. Hear me out. There was enough stuff never patched and enough diversity in the ecosystem already that even the org on top of patching could not patch everything.
As such, embargo were *already not that useful*, because a script kiddie was already in a target rich environment that were easy to attack.
And on the higher end of threat models, you were not escaping an attacker with a real budget anyway, because finding new bugs was never that hard, it is just that nearly noone had a significant budget for it.
So the only real threat model affected by this is ... the person or org directly targeted by a "good hacker with no budget". What I call the "middle of the hacking market". Thing is.. you already could not really defend against it that easily, but also... it basically never happens.
So... What does this "new capability" change actually?

2026-07-24 17:30:43 GMT

- reply

@nprofile…g4gm they are doing that. I know some that are. Do not give ideas to the lawnmower

2026-06-29 07:59:07 GMT

If you ever wonder what I mean when I keep going back to "if you want better FOSS infrastructure, fix the tools", consider the time spent on this build problem. Then compare it to the average budget of "2 to 4h per quarter" of a hobbyist maintainer.
The problem is not that we have little ressources. The problem is that we spend it in useless build system and dependencies side quests.
https://algassert.com/post/2603

2026-06-18 08:14:18 GMT

- reply

@nprofile…2vzh that these honestly do not change the cyber security risk. The bugs were already there and could be found. It is not like these tools magically discovered new classes of bugs.

2026-05-14 06:09:24 GMT

- reply

@nprofile…yzy8 iirc PowerToys is open source and got a tool to do that recently. Maybe worth having a look?

2026-04-09 21:36:53 GMT

- reply

@nprofile…pz53 hmm actually, as a french, I am not sure this say that all ministers will move to Linux. It can be interpreted as only saying that the DINUM own workstations will move to Linux. This is a far smaller park, mostly of people already working on the IT stuff itself

2025-12-17 12:53:47 GMT

So @nprofile…eae7 published the report on their experiment with Fellowships program.
And I love it. I love it because the results are so frigging good and align with the model of open source maintainers I keep pushing forward.
And it gives me a bit of hope. At least we have some support for the model of the problem. And possible solutions.
Let's make it better for everyone!
Thanks you @nprofile…ngvk
https://www.sovereign.tech/publications/evaluation-sovereign-tech-fellowship-2025

2025-06-30 07:04:59 GMT

- reply

@nprofile…cl5w i call it "opposition research". Same as reading management books

2025-03-25 08:26:37 GMT

- reply

@nprofile…dewn I mean I have an answer.
You need the knowledge in their head to make a SBOM. Cue the Python one, which iirc was made possible only because the devs/maintainers could list from their heads which deps there were, where, etc

2025-02-22 07:19:35 GMT

- reply

@nprofile…d2rl firing and replacing the JAGs is also... Quite the statement...

2024-08-17 10:52:44 GMT

- reply

@npub1xr8…3q0g or how long
It took us a good century of political instability to come back to a relatively stable system

2024-05-02 23:00:54 GMT

For everyone that calls for ways to make open source more secure, or for all their magical solutions that will provide money and resources to FOSS maintainers, please read this.
This is a rare account of the reality of maintainers, things that are hard, but also how much knowledge and niche expertise you need for *anything* in there.
That is why just giving money to experts will not help that much. It is too hard to train experts in this. But we may make it easier
http://rhaas.blogspot.com/2024/05/hacking-on-postgresql-is-really-hard.html

2024-04-01 20:52:55 GMT

Well, I finally have data to back my model of the software world out there. And the data is relatively solid and shows what I keep saying.
You are all on our turf now. Please accept that you have no idea what you are talking about. Sit down. Listen. Ask questions.
But respect our work. We are trying to keep the world running, 1h per month.
https://www.softwaremaxims.com/blog/open-source-hobbyists-turf

2024-02-27 13:22:30 GMT

The White House declared we have to be Memory Safe now!
So great! None of us had any idea!
Wait, but why is there no analysis of how we are still memory unsafe decades after the start of these yelling about it?
Let's me re share my answer to that crowd from a few months ago. I am *definitely* not bitter. Defo.
https://www.softwaremaxims.com/blog/memory-safety-end-history

2024-01-13 06:49:19 GMT

Why not do #FollowFriday in here too? Even if it is Saturday for me.
@npub1psd…9sr7 for being a good voice to highlight the economic and tech stuff just under the surface
@npub184n…tqd0 for being a far better blogger than me around Safety science
@npub1unv…cwrs for being a voice of reason in the infosec crowd
@npub1rkt…sqek for bringing a needed lens to look at the SV beliefs
@npub13t5…qflp for being a good sport about my dump yelling at infosec
Ty all!

2023-09-02 09:25:51 GMT

- reply

@npub1psd…9sr7 @npub1upm…mm0t @npub1g3j…k5cu @npub1dme…ch6s I mean, on the other hand, 10 years LTS is... really expensive if not impossible. Computers are not some magical thing frozen in time. Maintenance costs rise fast, and not linearly with time, especially with context change.
I totally agree with your point on the UX change ofc, but for example, in terms of shell, as he mentioned in the article... Nushell is not really meant to replace your use of shell. It is built to replace glue scripts. And yes. needed.