This paper is excellent for many reasons, but I want to emphasize how approachable it is. Anyone working as a developer can read this and get insights.
This stands in s t a r k contrast to other disciplines (e. g. Physics) where papers are usually ultra dense, making it hard to read even for subject-matter experts.
I wrote a paper about how I think trust should work for software dependencies.
It very much builds on the hash-based cache lookup mechanism this paper calls constructive traces (in contrast to what they call deep constructive traces) to eliminate transitive trust relationships.
This paper is so important. Just imagine how much pain could have been avoided if the Gitlab and Github developers read this before making the steaming shit pile of Github Actions.
6 comments
[ 3.3 ms ] story [ 23.7 ms ] threadThis stands in s t a r k contrast to other disciplines (e. g. Physics) where papers are usually ultra dense, making it hard to read even for subject-matter experts.
It very much builds on the hash-based cache lookup mechanism this paper calls constructive traces (in contrast to what they call deep constructive traces) to eliminate transitive trust relationships.
https://dl.acm.org/doi/10.1145/3689944.3696169
Buck and Buck2 from Meta are descendants. Buck2 is an excellent piece of software. Too bad it is still niche.