Activity
Stars and mentions · Last 30 days, Oct 5 – Nov 3
Top repositories
zimbatm’s repositories ranked by new stars, as on trending.
Contributes to
Repositories outside zimbatm’s account where zimbatm opened or reviewed pull requests in the past 365 days.
Who noticed zimbatm
Everyone who starred or forked zimbatm’s repositories since the archive began in 2011.
Notable accounts
Ordered by the stars their own repositories have received.
Biggest fans
Accounts that starred the most of these repositories.
Breakout weeks
Each repository’s best week of new stars, with the release published around it.
Achievements
Awards earned by the repositories zimbatm owns. Select an award to embed its badge.
No awards yet
Repositories earn awards by reaching the top three in a completed trending day or week.
A repository earns an award for finishing first, second or third in a completed trending day or week, ranked by new stars, new forks or pull request authors. Awards follow a repository through renames and transfers and count toward its current owner. Weeks run Monday to Sunday, UTC.
Mentions
> Oh, you have a detailed package inventory or, dare I say it, SBOMs? That's really nice. Do show me where that lists the various vendored or hard-coded CA trust bundles. Yeah, I didn't think so.3 Interesting the Author linked to nixos issue here, if you follow that link you end up at nix-cacert-scan, a tool that scans your system nix closure for packages that contain TLS certs, and from there you can find out why any package includes it and add overlays to patch any such packages, even add automation to your pipeline to detect compromised certs throughout your whole system. I think this is one of the strengths of nixos, it is a pity it isn't more focused on security, missing things like signed commits on nixpkgs, built-in kernel hardening, musl builds. nixpkgs is also so huge and interweaved, it would be nice if a secure core was separated out (before someone commercial does it.)
This incident somehow exposes another previously overlooked issue. I just notice that so many softwares vendor their own version of CA store for no particular reason [1][2]. It is relatively easy to patch system CA bundles. It would be quite challenging to patch every binary that embedded their own CA. As such, many systems will remain vulnerable for quite some times. [1] nixpkgs#576475 [2] zimbatm/nix-cacert-scan