1
We should all be using dependency cooldowns
See cooldowns.dev for up-to-date information on cooldown adoption across various languages and package ecosystems.
William Woodruff
TL;DR: I’ve turned my April post on Brocards for vulnerability triage into a more permanent website. You can now link to each brocard directly, like this , without having to worry about link rot 1 .
- Popular posts
- 19
- Total points
- 4,095
- HN comments
- 2,920
- Rank
- #310 personal
Visit blog.yossarian.net → RSS feedOn Hacker News May 2020 – Aug 2026
Software Engineering 11Systems & Performance 5Tools & Productivity 4Programming Languages 4Security & Privacy 3Infrastructure & DevOps 3
2
GitHub Actions could be so much better
I love GitHub Actions: I’ve been a daily user of it since 2019 for both professional and hobbyist projects, and have found it invaluable to both my overall productivity and peace of mind. I’m just old enough to have used Travis CI et al. professionally before moving to GitHub Actions, and I do not look back with joy 1…
3
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…