iveqy

The way I usually solve this is by using git submodules.

It does not solve all supply chain issues, it do solve some supply chain issues.

Not being able to see if the source code shipped is the same as been used for creating the binary is scary

Seems as a good idea to pitch git-appraise https://github.com/google/git-appraise

I'm not part of the project at all, but this is the only offline code review system I've found.

I built my own ERP system for handling my business. It's also an TUI and has been here on Hacker News a few times.

About training new staff, there's actually studies done on it: https://pmc.ncbi.nlm.nih.gov/articles/PMC2655855/

My 2 cents is that GUI is good for exploring new software, while TUI is wonderful if you already have a mental map of what you're doing. So for everyday used software I would definitely hope that more TUI's where used.

I'm looking for something that you can embedd in your own application. LaTeX would be great but it's not really nice to have WEB code in your C application. It's also has a bit troublesome license.

I hope you've found https://stackoverflow.com/questions/1711631/improve-insert-p...

It's a very good writeup on how to do fast inserts in sqlite3

Om working om a distributed erp system. The goal being native ui in android, iOS, Mac OS, web, windows, Linux and curses with crazy fast response times. No user operation takes longer than 100 ms.

I'm working with SBoM, one fun side effect is that you can scan SBoM's for vulnerabilities. Suddenly hackers, your customers and your competitors starts do to this and you need to make sure your third party dependencies are updated.

This reveals the cost of dependencies (that often are ignored).

I hope that we in the future will have a more nuanced discussion on when it's okay to add a dependency and when you should write from scratch.

I also switch between a lot of computers (work computer at home/work computer at work) but have to develop on "big powerful machine at work". My current solution is tmux + nvim and it works really good. I can just pickup a session from whatever computer I'm in front of at the moment.

Am I correct in that neither Zed nor VS Code support this usecase yet?

I think you'll like dwm and other suckless tools. They have configuration as code and require a recompile after a configuration change.

I strongly disagree. You should always keep the code as simple as possible and only add abstractions once you really need them.

Too many times I've found huge applications that it turns out be most scaffolding and fancy abstractions without any business logic.

My biggest achievement is to delete code.

1. I've successfully removed 97% of all code while adding new features. 2. I replaced 500 lines with 17 lines (suddently you could fit it on a screen and understand what it did)

Also: https://www.youtube.com/watch?v=o9pEzgHorH0

This seems to be almost the same as androids repo tool. https://android.googlesource.com/tools/repo

Personally I don't see the difference between this and submodules. Repo stores the information in xml files, vdm stores it in yaml files and git submodules in the git database. I don't really care.

The real headache for me is the trouble of traceability vs ease of use. You need to specify your dependencies with a sha1 to have traceable SLSA compliant builds, but that also means that you'll need to update all superrepos once a submodule is updated. Gerrit has support for this, but it's not atomic, and what about CI? What about CI that fails?

The beauty with a static site is that if you have a copy of the generated output, using the site generator becomes optional. You can always move away from using it (but not moving back).

This means that a "custom buggy sitegenerator" is never a bad dependency to have.

Git is actually using that approach which means that libgit is pretty useless to embed, which noone does anyway since it's GPL and everyone instead uses libgit2.

I'm actually developing this as a ERP system. It has been featured here a few years ago, and old demo can be found here: https://www.youtube.com/watch?v=W3kpD7om_aQ

The goal is to have a fully distributed multi UI ERP system, with TUI, web, android, ios, etc. all native. It's moving forward every year :)

PlasticSCM has semantic merge that does something like that: https://docs.plasticscm.com/semanticmerge/intro-guide/semant...

I would really love to read a comparison with sourcehut

Developers has solved this is most VCS by merging changes. The trouble with merging is that it's hard to explain and hard to visualize for non technical users. Once that problem is solved, there's a lot of nice tools to use for collaborative experiences.

There more I work the less I care about no-code or development languages.

The cost is in requirements and dependencies. The tools and implementation is the cheap part.

Isn't it a huge performance problem? Running a headless browser is quite heavy?

So far it's an one person thing, I've been working on it on and off for 11 years. It has a this UI layer meaning that I so far has a text interface (that you can see a demo of here https://www.youtube.com/watch?v=W3kpD7om_aQ ) and a webb interface. Planning on adding android, ios, windows and os x as well.

Right now I've: Accounting, CRM, Email, Products, Invoices, Quotes, Password manager, Tickets/Todos, Projects and basic IoT device monitoring and a static webpage generator. Most modules let the user add their own fields to a module so you can make if fit your needs.

Apart from this there's also lua support for reacting to events. Upcoming is webshop capabilities and cronjobs.

Feature sets are hard. But I'm prioritizing things my customers wants and what I need.

I would love to but I'm planning to make it a living off it and haven't really figured that part out yet. https://www.youtube.com/watch?v=W3kpD7om_aQ

Unfortunately not, it’s a complicated process. I’m working with a software that does this and is using wktmltopdf and it’s a real mess

Really nice to see! Since the past several years I'm working on a text based ERP system (that of course do invoicing as well). Nice to see that there's a demand!

I'm curious about the security implications with using distcc. Doesn't this mean that if one computer gets compromised, the attacker can run code on all other computers using distcc, or secretly inject malicious code in the build result.

So using distcc means that all computers using it must be trusted. And that means that using it on "all developers computers to share the load" is good for performance but bad for security.

You probably already seen it but here's a very good write up on how to improve insert performance: https://stackoverflow.com/questions/1711631/improve-insert-p...

I tried to use it, but my git repo was too big and it become painfully slow. I filed a bug an the issue was fixed within a few weeks. Very good interaction with the developers!

However that also meant that I needed an alternative. So let's break down what soft-serve do: 1. It's a ssh server/git server 2. It can list git repositories 3. It can browse git repositories

For: 1. you can use your current ssh server and for extra protection use the git-shell that comes with git. 2. Is easily solved with git-shell-commands (see man git-shell) 3. Is not something I need. If you want to browse you'll need to clone.

Although soft-serve is beautiful, it's a lot of added complexity for not very much functionality. If/when they add CI/CD, pull requests (perhaps a git-appraise based interface). It will be awesome and I'll give it a new try.

See my comment about apkovl

Looks a lot like apkovl https://wiki.alpinelinux.org/wiki/Alpine_local_backup for Alpine linux. Not the most easy to grasp documentation but it's basically a package (apk, similar do rpm or deb) that each has its own overlayfs.

I think there's actually something in this. That's why I've created my own CRM/ERP system. All page loads that are slower than 100 ms is considered a bug and I'm usually on under 50 ms.

And of course I've a TUI version of it as well, with all data local (and synced to the cloud).

I really hope that once I'm ready to put it out there, I will find the right audience.