I think this is a killer project that's very needed to accelerate the learning of how to defend against the deluge of nascent CI/CD risks. Kudos Boost team!
Do you have a working example of a skill reducing tokens on repeat tasks? I'm personally seeing the cost of writing and maintaining skills to be much larger than the tokens I'm saving by doing so.
I've worked in software supply chain security for two years now and this is an extremely optimistic take. Nearly all organizations are not even remotely close to this level of responsiveness.
> Here's the trick: github.actor does not always refer to the actual creator of the Pull Request. It's the user who caused the latest event that triggered the workflow.
Surprisingly, in this context, I frequently came across interfaces that make it difficult to implement certain features using those libraries. There's not a one-size-fits-all implementation yet.
I think you're going to scarcely find a company that has a direct open source -> hire pipeline. However, one of the most valuable parts of contributing to open source that I have personally found is forming connections and having those connections referring you to companies. I encourage you to find a company + project combination that you enjoy, find ways to collaborate, and make relationships. Doing that will likely yield huge dividends.
As someone deeply familiar with this problem (ex-JupiterOne), I'd caution against asserting that 'deep level of customization' is a differentiator. Your buyer (CISO) and userbase (Sec Engs) are drowning. They (and I) don't want yet another product to build on top of. This is a key reason why Wiz is so successful -- an operator can turn Wiz on and immediately receive value, no adjustments or additions needed.
I'd strategically focus on making the 'actionability' part the cornerstone of the product and really become obsessed with making that part of your product incredible. The Goliath-killing story you need will be formed by figuring out how to get your product to the point where someone can turn it on and immediately receive value for the most impactful security problems first (ex: Log4J) and the total surface area of problems the product solves for second.
Do you have any comments on how to best absorb Ficciones? I read it recently and struggled through the whole book, needless to say, I don't comprehend why many hold that book on such a high pedestal.
I interpreted the parent to mean that it might not be fair to assume existing package managers have done a _great_ job at downloading and verifying, especially verifying, resources from the network. There are businesses that exist attempting to solve this problem like socket.io. Safely installing the correct dependencies for a project is still not a guarantee from any of the major package managers.
Is it necessary to specify TCP/IP? Is it not also applicable to books? Reading piles of pulp fiction is subtly different than language-flavored entertainment.