In my 2023 ACM talk, to illustrate how supply chain security is more than just build deps graphs, I showed a graph of the servers involved in building and serving Go releases.
Has anyone done something like this but for GitHub Actions? We have examples now of attacks moving between actions.
For example, in 2025, a successful attack on the GitHub Action reviewdog/action-setup was used to infect the Action tj-actions/changed-files, with an ultimate target of coinbase/agentkit. www.wiz.io/blog/new-git...
If this podcast episode is the only good thing that comes of AI, it will have been worth it—
Build deps get attention largely because they are easily computed. Other relevant dep graphs that are harder to compute are ignored.
The GitHub Actions graph is clearly relevant to attacks and should be easily computable from public repos.
What are the 'is-even's of GitHub Actions? Who owns them?
“Pulling a New Proof from Knuth's Fixed-Point Printer”
Happy 88th Birthday to Don Knuth!
And thanks again to @robpike.io for Ivy.
research.swtch.com/fp-knuth
Are you still hiding if no one is looking?
People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points.
Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing.
www.aikido.dev/blog/glasswo...
“Floating-Point Printing and Parsing Can Be Simple And Fast”
The fastest known floating-point printer and parsing algorithms - fixed-width printing, shortest-width printing, and parsing, all in 400 lines of Go.
research.swtch.com/fp
research.swtch.com/fp-proof
Russ Cox
Russ Cox
Russ Cox
rob pike
Russ Cox
Russ Cox
Russ Cox
Russ Cox
It may or may not be true that whether or not you race to use AI heavily right now will determine whether you’re part of a future wealthy elite ruling class or are left behind in poverty and powerlessness.
But if it is true, this strikes me as a deeply immoral future worth fighting hard against.
bethmathews.substack.com/p/why-so-man...
Last summer, Bryan Vance found himself in an argument with a stranger on Reddit. Vance, a Portland-based journalist who runs Stumptown Savings, a newsletter covering local grocery deals, had been accu...
