Comment by stasher-dev

6 days ago

Thanks for raising these concerns — totally fair in the context of security tools.

I’m not anonymous, just cautious. I’m a solo builder, and this is a focused identity for the project. In fact, that's why I implemented full supply chain transparency from day one: signed releases, SLSA attestations, SBOMs, and Rekor logs. You don't need to trust me you can see the code for your self.

Ultimately, you're right — if you can't verify it, you shouldn't trust it.

That’s the whole point of the system: zero trust and verifiable cryptographic guarantees.

Appreciate the scrutiny

18 comments

stasher-dev

Reply
cmeacham98  6 days ago

A "focused identity" with no links to other identities is anonymous by definition.

More importantly, this project is not "zero trust" and calling it such is borderline deceptive.

I can verify the artifacts you're shipping contain the code in the repo (or I could just clone the repo myself), but I cannot automatically verify that your code is non-malicious and free of bugs. That is what I am trusting when using your software, and I have serious doubts about the "free of bugs" part for AI generated software.

  • loloquwowndueo  6 days ago

    I’m right there with you in mistrusting AI generated code but - you also can’t automatically verify that human-written code is non-malicious and bug free.

mbreese  6 days ago

Cryptography/security is a trust business. Without some kind of personal (or even project) history, I know nothing about you or the project. And if I can’t verify you, I can’t trust you. The rest doesn’t matter much to me.

But maybe that’s just me.

  • stasher-dev  6 days ago

    I get it. An 'anonymous' author is a deal breaker for some. I respect that.

    The repo is public. The releases are signed. The attestations are published. Nothing hidden.

    If that’s not enough — totally fair and I am sure many others would agree. Appreciate your point of view and taking time to give feedback.

cmeacham98  6 days ago

I also now see that you're using em dashes in your replies - are even the HN comments AI generated???

  • ramon156  6 days ago

    Some colleagues use LLMs to translate their messages to English. Same can ve applied here

  • natch  6 days ago

    Humans also use em dashes — like that. My browser for one automatically creates them on HN if you correctly type a space, two hyphens then another space. Maybe the dude just has good grammar.

  • wrs  6 days ago

    Everyone please just stop with the em dash hysteria. You just tried to use one yourself — apparently you just don’t know how to type it.