Dan Lorenc (@lorenc

Dan Lorenc

13.2K posts

Dan Lorenc

@lorenc_dan

OSS Supply Chain Security. Founder/CEO/Primary Ariba Admin at chainguard.dev Sigstore: sigstore.dev

The Arena

Joined May 2014

Pinned
Dan Lorenc
@lorenc_dan
Nov 1, 2023
Big week for @chainguard_dev!
Chainguard raises $61 million series B round as enterprises move to fortify open source software
From chainguard.dev
Dan Lorenc
@lorenc_dan
Mar 23, 2023
Too soon?
Dan Lorenc
@lorenc_dan
Nov 26, 2023
Your CTO showing the team he can still "get his hands dirty" and debug a production issue.
Historic Vids
00:00
Historic Vids
Dan Lorenc
@lorenc_dan
Jun 15, 2023
I'm so mad about this.
9to5Google
@9to5Google
Jun 15, 2023
Google Domains shutting down, assets sold and being migrated to Squarespace 9to5google.com/2023/06/15/goo… by @technacity
Dan Lorenc
@lorenc_dan
Nov 5, 2025
Google literally runs a program to pay people to fix bugs in critical OSS projects. Ffmpeg is explicitly in scope. Anyone can just send a fix and fill out a form and get paid. github.com/google/bughunt… This is all so dumb.
Dan Lorenc
@lorenc_dan
Apr 30, 2023
if you’re not rolling your own compiler I don’t trust you compilers have to be one of the most easy things to implement and they're such a core component to any service. Own your compiler.
Dan Lorenc
@lorenc_dan
Dec 24, 2019
Instead of SemVer, I propose RealVer It has three parts, referred to as X.Y.Z. X: Name/number marketing decided. Y: Number of releases since leadership decided we needed a refresh and new name. Z: Number of times we screwed up the last release.
Dan Lorenc
@lorenc_dan
Apr 21, 2021
Is there a word for when you make a piece of software that probably isn't really ready for production use, then forget about it, then someone comes along and builds a critical production system on top of it without asking?
Dan Lorenc
@lorenc_dan
Nov 17, 2022
Replying to @d_feldman
Think bigger! There's gotta be someone that took two faang jobs simultaneously and now has two severance packages.
Dan Lorenc
@lorenc_dan
Oct 12, 2022
The core problem is that k8s allows us to treat containers as cattle, but images are still treated as pets. "Mom, I want this new image!" "Who's gonna take care of it?" "Me!" "You're gonna feed it and walk it and scan it for CVEs?" "Uh huh!" "Even when it's raining?" "Sure..."
Dan Lorenc
@lorenc_dan
Nov 5, 2025
Fun fact: at one point Google had an entire team building a new sandboxing technology just so they could run ffmpeg safely. Later it ended up being used in App Engine and other environments.
Dan Lorenc
@lorenc_dan
Jun 13, 2023
Engineer's hierarchy of needs
Dan Lorenc
@lorenc_dan
Dec 12, 2021
Funding OSS is a hot topic today! I got to spend a lot of time over the last two years working on paying OSS maintainers at @Google. We spent a few million dollars and funded some relatively high profile work, in addition to a lot of smaller projects. A 🧵on problems I saw!
Dan Lorenc
@lorenc_dan
Aug 20, 2022
HAVE YOU HEARD OF NIX? ITS A PURELY FUNCTIONAL DECLARATIVE REPRODUCIBLE PACKAGE MANAGER. ALL UPDATES ARE ATOMIC AND YOU JUST HAVE TO LEARN HOW TO OPERATE THE CLI WHICH IS KIND OF LIKE GIT EXCEPT THE HARD PARTS. IT HAS A CUSTOM LISP DIALECT TOO I CANT BELIEVE YOU HAVENT TRIED IT!