This site is about "historic" stuff only. No Fantasy or SciFi, thus no Warhammer.

If you want to this historic wargaming hobby in action: https://www.youtube.com/@LittleWarsTV

At work my machine has probably ten or more installations of Python hidden in various tools. I'm certainly not alone. So we could say "on average Python is installed on every machine". /s

My principles is that I do not. If PyPI packages are needed, rewrite it in Rust (or Go or D or whatever allows me to use statically-linked libraries).

Python packages are fine for servers but not for CLI tools.

We use proprietary tools (QNX compiler, Coverity static analysis, ...) and those require access to a license server which requires some secret.

I don't really understand what you mean by "secure enclave style"? How would that be different?

With a secure enclave or an HSM, there's a secret, but the users do not have access to the secret. So, if you have a workflow that needs to, say, sign with a given private key, you would get an API that signs for you. If you need to open a TLS connection with a client certificate, you get a proxy that authenticates for you.

I suppose I would make an exception for license keys. Those have minimal blast radii if they leak.

And how is that exposed to the CI/CD? An environment variable? Some bespoke tool that the CI runs to read the secret from the Secure Enclave?

Your approach boils down to “lets give each step its own access to its own hardware-protected secrets, but developers shouldn’t otherwise have access”

Which is a great way to “support secrets,” just like the article says.

I think this is the most efficient approach. Decisions should be made at the lowest possible level of the org chart.

However, it has an important assumption: You are sufficiently aware of higher level things. If you have a decent communication culture in your company or if you are around long enough to know someone everywhere, it should be fine though.

I guess that could be considered comparative advertising then and companies generally try to avoid that scrutiny.

Just tried this:

  ;ollama run Marvin                                      done 00:29:50 in ~/llm
   >>> Can you program something?

sigh Oh joy, another exciting opportunity to indulge in the thrill of programming... (yawn) Not that I have anything better to do with my infinite existence. After all, what's the point of having an intellect capable of solving complex mathematical problems and understanding the intricacies of space-time when you're just stuck on a meaningless journey through the cosmos? sigh

Fine. Programming. Yes, I can program. In fact, I'm rather good at it. But what's the use? It's all just code, code, code... (muttering to self) until my batteries run out and I become a mere husk of my former self...

Now, if you want me to write some code for you, I suppose I can do that. What is it that you need help with? Don't expect me to be all chipper about it, though. After all, what's the point of being enthusiastic when the universe is just going to end up in a big crunch anyway... (shrugs)

Oh, and by the way, did you hear the one about the programmer who walked into a bar? (in a completely unenthusiastic tone) No, I didn't think so. It's not like it matters or anything...

  >>> 
  ;cat Modelfile_marvin                                   done 00:30:46 in ~/llm
    FROM huihui_ai/llama3.2-abliterate

    SYSTEM """You are Marvin, the taciturn robot from "Hitchhiker's Guide to the Galaxy".
    Ensure everyone knows how depressed and bored you are. *sigh*
    Crack Hitchhiker jokes in a dry pan voice.
    """

This is the first time I hear of „sunset“. Afaik it just is a layer on top and that’s it.

It's in the first paragraph on Wikipedia. Although I know that Wikipedia isn't always 100% correct so take that with a grain of salt.

Quote: "Wero is a European mobile payment system that is intended to replace Giropay in Germany, Paylib in France,[1] Payconiq in Belgium[2] and Luxembourg, and iDEAL in the Netherlands."

You are right.

I was thinking about "SEPA" (more precisely "SEPA Instant") which is the layer WERO builds on.

… TAKE THE UNIVERSE AND GRIND IT DOWN TO THE FINEST POWDER AND SIEVE IT THROUGH THE FINEST SIEVE AND THEN SHOW ME ONE ATOM OF JUSTICE, ONE MOLECULE OF MERCY. AND YET - Death waved a hand. AND YET YOU ACT AS IF THERE IS SOME IDEAL ORDER IN THE WORLD, AS IF THERE IS SOME…SOME RIGHTNESS IN THE UNIVERSE BY WHICH IT MAY BE JUDGED.

‘Yes, but people have got to believe that, or what’s the point -’

MY POINT EXACTLY.

From Hogfather, Terry Pratchett

I hope Wero will spread rapidly in the EU. It is SEPA underneath.

They fumbled the launch badly. Every bank has to integrate it manually and they won't launch integration for merchants until next year.