It's not about outages. It's about the why. Hardware can fail. Bugs can happen. But to continue a roll out despite warning sings and without understanding the cause and impact is on another level. Especially if it is related to the same problem as last time.
And yet, it's always clownflare breaking everything. Failures are inevitable, which is widely known, therefore we build resilience systems to overcome the inevitable
You don't need outages to build experience in resolving them, if you identify conditions that increase the risk of outages. Airlines can develop a lot of experience resolving issues that would lead to plane crashes, without actually crashing any planes.
No. There is 0 reason to be toxic or an asshat in general. It should not be accepted. He might have reasons to be protective, but one can do that in a respectful manner. But going around, making something up, banning people for asking or criticizing is not the way to go.
Once you make something public it's not a private garden anymore.
> No. There is 0 reason to be toxic or an asshat in general. It should not be accepted.
So, you wanna shame or force him into accepting contributions? That's ridiculous!
> Once you make something public it's not a private garden anymore.
Wait, are you saying if I have an actual garden that I myself own and maintain, and I let random people from the street come see it between noon and five every Sunday, it's no longer my private garsden? Then you and I are on different planets in this debate.
You forgot to quote the part where I said he can refuse in a normal and respectable way.
If you make a garden and then declare it a public garden then yes. If you want people to not step on your flowers you can tell them in a normal way. No need to shout around, belittle them, and ban them from your garden for a year....
He could have just kept his Project private if he doesn't want people to interact. Simple as that.
> If you make a garden and then declare it a public garden then yes.
He didn't. He made a garden, declared it private, and set specific terms under which you and I and others can come enjoy it. Take it or leave it.
> No need to shout around, belittle them, and ban them from your garden for a year....
Then follow his rules, or don't go to his garden! He's offering you a free favor. Take it or leave it.
> He could have just kept his Project private if he doesn't want people to interact. Simple as that.
Of course he could have. However, I'm adamant that those of us who find Valetudo useful – i.e. find his garden beautiful – would be worse off for it. Why would you want the overall usefulness given to the world to decrease? What's the benefit? Not feeling annoyed that he won't let you help?
> Also even if it is open source, who really verifies the binary is built from the source published?
Apple notarization is usually the way for non Store downloads. Non-notarized apps present a warning and require overriding security settings to run (with admin privilege). There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub, only that some sanity checks have been performed and the binary is not a known threat (or has been modified).
> There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub
Sorry what if the open source project made their CI/CD pipeline public? So users could exercise it, produce their own build, and then compare that to the notarized one? Would I then be able to verify that what I downloaded from the developer’s website is identical to what is built with the open source code? Just curious.
Yeah there is support for API notarization, so in principle you could have an audit trail that some automated build process got a specific notary result that's "stapled" to the app. I'm not familiar enough to say how trustworthy that approach is, or what exactly you'd need to prove it. And yes, aim for a reproducible build that produces assets with checksums that can be matched to the distributed one.
The mitigation is if someone finds out a (notarized) download is compromised, they can tell Apple and they can retroactively and quickly revoke the signing which is distributed via Gatekeeper. Other users should get the warning if they had previously run the app without an issue.
In theory, yes, you could compare it. In practice, the build would need to be reproducible which is non-trivial depending on the size the of the project and the external dependencies the project itself has.
Mac app store distribution is not that common. Some apps are available in the store or as direct downloads. The store adds the sandboxing restrictions, which dont work for many apps, eg its not very easy to install a cli.
Replying to mail that arrived through masked email addresses will also reply with the masked email address and not accidentally leak your main address.
Also creating masked mail addresses in the first place.
reply