Can I install nix securely (eg with apt) to run inside the free CI runners provided by GitHub, GitLab, and Codeberg?

You can pay for signed images from someone else

Can you tell me a bit more about this? Who are the major providers?

We do our pre-releases on CI runners for convenience. GitHub automatically kicks-off a build when we git push.

When it comes time to do a real release, we can just run the job locally on our build machines (this is easier thanks to docker). Because our builds are reproducible, we can just check that the hash matches on our local build and the one from the free GitHub CI runners. That way we don’t have to trust the infrastructure, but we can use it for free & easy iteration before our final release.

Yes, you have to trust someone.

However, by using cryptographic signatures on release artifacts (eg container image layers), we can reduce that risk from having to trust tens of thousands of people to just one person.

That’s a hugely meaningful reduction of risk.

How could monitoring a firewall log protect you from a Publishing Infrastructure Compromise or MITM attack? It would just show the malicious image being downloaded from the expected source…

Because the hash comes from the same source as the image itself.

So if someone compromised the publishing infrastructure (or does a MITM attack), they can trivially maliciously modify the hash as easily as they can maliciously modify the image. It provides zero security to Publishing Infrastructure compromise.

A good historical example of this happening was when monero’s release infrastructure was comprimised. And here’s a great list of historically relevant cases where this happened:

• https://github.com/cncf/tag-security/tree/main/community/catalog/compromises

In the case of Monero, the users were able to verify that the release was malicious – because the cryptographic signature was invalid, and it was fixed very fast. If the user can only check checksums, they have literally no way to detect if the publishing infrastructure or a MITM attack is taking place.

With cryptographically signed images, you don’t need to trust Docker Hub nor the source code nor the base image. You just verify the signature that could only have been made from the developer. You trust the private key and the developer only, which significantly reduces the vector of attack (publishing infrastructure, X.509, docker hub admins, etc) by magnitudes.

Thanks. I assumed the client would figure it out automatically, but I guess that only works for links?

Is there a way to edit a post to indicate it’s a cross-post?

but how do you verify the sources of what you’re fetching?

Is it coming from an unsigned git repo? That seems equally vulnerable

but how do you verify the sources of what you’re fetching?

Is it coming from an unsigned git repo? That seems equally vulnerable…

Open-Source Software.

Can I install nix securely (eg with apt) to run inside the free CI runners provided by GitHub, GitLab, and Codeberg?

If you have the budget, probably the best option is Robot-Coupe

• https://www.robot-coupe.com/usa/en_US/listing-produits/f/cutter-mixers/18205

The motors are measured in HP (Horse Power), not watts. And you can get one with a stainless steel metal (not plastic) bowl.

I highly recommend the Cuisinart 14-cup Food Processor.

You can find them used for $100-$300. I think the new ones are probably be fine, but it might be safer to get one manufacturered before 2021, when Cuisinart was bought by Conair. And probably avoid the ones with riveted blades, since in 2016 there was an issue where the blades broke apart, and people were injured by eating small pieces of metal.

The smaller 3-cup one is decent, but I broke it making peanut butter. It’s really not designed for that kind of abuse. So I wouldn’t recommend it.

But these 14-cup ones are tanks that will last generations. You can buy replacement parts. And there’s loads of used ones, so you should be able to get spare parts for generations.

Oh, you’re in luck. The UK makes the most durable boots on the planet

• https://www.vegetarian-shoes.co.uk/

I’d recommend the Euro Safety Boot as a starting point.

Stick to anything with the “vegetan micro” uppers. It’s the synthetic leather that the luxury yachts and cars switched-to decades ago, because it’s wayy more durable than leather. And (nearly) zero maintenance.

Here’s a review of their airseals after 7 years of abuse.

ah, final rinse with freshwater makes sense. You’re not thaat abusive ;)

Pots look great! Thanks for sharing

Unfortunately I can’t use YouTube. Do you have a link to the source articles? Or a video on PeerTube?

This article is great, thanks for sharing :)

Here’s the conclusion at the end:

What to buy instead

The counter-list in this category runs deeper than any I’ve covered previously, because cookware is simple enough that stubborn, family-run businesses can still compete. The pattern in who survived is uniform: nobody outside the family has ever been owed a return.
…

Stainless and carbon steel

• All-Clad: The bonded lines are still made in Canonsburg, Pennsylvania, sharp-rim settlement and French owner notwithstanding.
• Heritage Steel: Family-owned in Clarksville, Tennessee, building on old Vollrath tooling. The fully American clad alternative.
• Tramontina: Family-controlled in Brazil. The honest value play; their clad line embarrasses pans at twice the price.
• de Buyer: The carbon steel standard, still made in the Vosges. It belongs to Groupe SEB as of January 2025, so it’s one to watch over the next few years.
• Matfer Bourgeat: The French commercial standard, family-held, and what a lot of commercial kitchens use.

That said, Tramontina was one of the companies I contacted. They also said they didn’t know the thickness of the metal in their own cookware. Maybe I’d have a different experience if I called them in Brazil and spoke Portuguese :/

I’m also shocked that the article doesn’t mention Browne Thermalloy. I think they’re one of the best cookware brands on the market, but I can’t find any third-party reviews on the Internet about them – except one small thread on reddit. Browne’s support couldn’t tell me the metal thickness in their 3-ply cookware, but they said they’d forward my request “to their marketing department” (not sure why not their “procurement” or “engineering” or “product” departments), and I haven’t heard back…

That brand kept coming in my research as having very thick layers.

As stated in OP, my understanding is that induction-capable stainless steel use a less corrosion resistant (nickle-free) outer layer.

You wash that in salt water, and it doesn’t rust?

Which brand was it that warped? So we know to avoid them.

Do you have a link to a source with more info on the needed minimum thickness of the outer magnetic layer? I imagine there’s a point of diminishing return, and I’d love to see some research showing the efficacy of various thicknesses of this outer magnetic layer.