Fosdem on ¬ just serendipity 🍀

★ Open Source security in spite of AI

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 07 Feb 2026 11:12:24 +0100

♠ Open Source security in spite of AI by Daniel Stenberg¹ (of curl fame):

The title of my ending keynote at FOSDEM February 1, 2026.

As the last talk of the conference, at 17:00 on the Sunday lots of people had already left, and presumably a lot of the remaining people were quite tired and ready to call it a day.

Still, the 1500 seats in Janson got occupied and there was even a group of more people outside wanting to get in that had to be refused entry.

They say: “never meet your heroes”:

It is unwise to seek personal acquaintance with people whom one has regarded with high esteem, as they often fail to fulfill one’s expectations, resulting in disappointment

I had the opportunity to meet Daniel in person and I’m glad to state that I am not disappointed.

I was the volunteer who held the Q&A at the end for his talk, and that was a pleasure.

In my opinion, this was the best talk from FOSDEM 2026.

Recording. Slides. ↩︎

— § —

Reply via email

#ai #bestof #dev #fosdem #meta #posse #security #serenity

atuin: new machine setup

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 24 Jan 2026 18:46:02 +0100

♠ Previously.

Problem statement: you’re already using atuin, and have sync configured. You just got a new machine. Now, configure atuin in it.

If you self-host, configure your sync server first:

$EDITOR ~/.config/atuin/config.toml
# ---
## address of the sync server
# sync_address = "https://api.atuin.sh"
sync_address = "https://{your-server-here}"

Then log in to your server:

atuin login --username {username}
<type in password>

You can also provide the password with the --password switch, but keep in mind it will be logged to your shell history unless you take precautions.

The next step is to import your current history into atuin. If this is a fresh new machine then there’s no need to do so.

If you had been using it for a while but didn’t set up atuin from the beginning, go on:

atuin import auto

Finally, sync it once:

atuin sync

Syncing happens automatically, but it’s sensible to manually kick-off the initial sync upfront.

Fin.

— § —

Reply via email

#dev #fosdem #selfhosted

atuin: limit scope to current directory

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 23 Dec 2025 12:08:44 -0300

♠ Previously, previously.

Pressing C-r opens the global history search by default.

To limit the history lookup to the current directory only, keep pressing C-r.

The scope will cycle through:

Global > Host > Session > Workspace > Directory

This makes it easier to find commands previously executed in a given directory.

— § —

Reply via email

#dev #fosdem

Atuin: delete history entries

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 01 Dec 2025 13:35:27 -0300

♠ Deleting, scrubbing, redacting old shell history entries is now easier than ever, thanks to atuin.

% atuin search '^aws_login_headless' --delete
deleting 019ad59e973b7c139c4a1d67fe2155be
deleting 019ad59e973b7c139c4a1d40a0da15f1

First do the search without --delete, and then re-run the command with --delete if the output is what you expect.

You would want to do so in these two scenarios:

prevent irrelevant entries from showing up in C-r (history search), reducing clutter
delete sensitive entries e.g. passwords (docker login --password {foo})

Previously.

— § —

Reply via email

#dev #fosdem

★ Atuin

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 30 Nov 2025 13:35:54 -0300

♠ My current workflow to manage shell history is simple, I have this config in my ~/.zshrc.d/

# fzf: fuzzy file finder
if (( $+commands[fzf] )); then
        # alpine/arch, debian
        src_files {/usr/share/fzf,/usr/share/doc/fzf/examples}/{completion,key-bindings}.zsh

        # brew
        if (( $+commands[brew] )); then
                src_files "$(brew --prefix)"/opt/fzf/shell/{completion,key-bindings}.zsh
        fi
fi

fzf does it all.

I hit C-r and get fuzzy finding over all my history, this has been overpowering my productivity for ages, likely since university.

Then I found out I could go one step further.

Enter Atuin:

Making your shell magical

Sync, search and backup shell history with Atuin.

Installing atuin is simple: it’s available everywhere:

brew install atuin

Configuring atuin is simple, start by adding this snippet to your /.zshrc file¹:

# atuin: https://docs.atuin.sh/
(( $+commands[atuin] )) && eval "$(atuin init zsh --disable-up-arrow)"

Now run atuin import auto to import your shell history entries to atuin.

By default, atuin init binds both C-r and the up arrow. I find the up arrow binding disruptive.

I want my workflow to stay as close as possible to fzf C-r. --disable-up-arrow is essential for that.

Pressing C-r will invoke a fuzzy find window that behaves similarly to fzf, though it’s more powerful. It’s hard to describe, you must try it out.

This is enough to make the migration. Which makes me feel bad for having procrastinated for so long to do so. Trying out atuin has been in my TODO list for ages!

There’s an optional step of syncing your history with their remote cloud. Or with your own, because there’s an option of self-hosting a server (atuin server start). Self-hosting is optimal, but trying out their cloud first to get a feel of the sync experience is reasonable.

Syncing happens every hour by default, but this is configurable.

See sync docs:

Atuin can back up your history to a server, and use this to ensure multiple machines have the same shell history. This is all encrypted end-to-end, so the server operator can never see your data!

Anyone can host a server (try atuin server start, more docs to follow), but I host one at https://api.atuin.sh. This is the default server address, which can be changed in the config. Again, I cannot see your data, and do not want to.

You can create a ~/.config/atuin/config.toml to customize atuin. I added this:

## With workspace filtering enabled, Atuin will filter for commands executed
## in any directory within a git repository tree (default: false).
##
## To use workspace mode by default when available, set this to true and
## set filter_mode to "workspace" or leave it unspecified and
## set search.filters to include "workspace" before other filter modes.
# workspaces = false
workspaces = true

## which filter mode to use when atuin is invoked from a shell up-key binding
## the accepted values are identical to those of "filter_mode"
## leave unspecified to use same mode set in "filter_mode"
# filter_mode_shell_up_key_binding = "global"
filter_mode_shell_up_key_binding = "directory"

## Defaults to true. If enabled, upon hitting enter Atuin will immediately execute the command. Press tab to return to the shell and edit.
# This applies for new installs. Old installs will keep the old behaviour unless configured otherwise.
# Similarly to fzf C-r
enter_accept = false

## Defaults to "emacs".  This specifies the keymap on the startup of `atuin
## search`.  If this is set to "auto", the startup keymap mode in the Atuin
## search is automatically selected based on the shell's keymap where the
## keybinding is defined.  If this is set to "emacs", "vim-insert", or
## "vim-normal", the startup keymap mode in the Atuin search is forced to be
## the specified one.
# keymap_mode = "auto"
keymap_mode = "vim-insert"

enter_accept is an important tweak to resemble fzf. By default, pressing Enter when looking up history entries in atuin will automatically execute the command. In fzf you have an opportunity to edit/tweak the command before execution, which is what I prefer. Set enter_accept = false to achieve the same behavior in atuin.

atuin has an option to manage dotfiles:

While Atuin started as a tool for syncing and searching shell history, we are building tooling for syncing dotfiles across machines, and making them easier to work with.

At the moment, we support managing and syncing of shell aliases and environment variables — with more coming soon.

…but I don’t feel the need to use this.

The magic of atuin, when using multiple computers is its shell history synchronization. Picking up the slack in my personal computer would reveal my work computer history and vice-versa. In some environments this is very welcome!

Also cool: stats for free:

% atuin stats
[▮▮▮▮▮▮▮▮▮▮] 4540 git commit
[▮▮▮▮▮▮    ] 3062 ack
[▮▮▮▮▮     ] 2636 vim
[▮▮        ] 1304 cd
[▮▮        ] 1240 fd
[▮▮        ] 1186 tsh
[▮▮        ]  915 grep
[▮▮        ]  913 just
[▮         ]  822 git add
[▮         ]  818 git nb
Total commands:   29464
Unique commands:  20610

Query past entries with a SQL-like CLI:

% atuin search --exit 0 --after="4 months ago" "^skopeo"

Clearly I’m a die-hard ack fan. Will I ever switch to rg?

just is starting to become part of my core tool belt.

See also: Tech Talk, including slides.

Next chapter: Atuin Desktop.

bash, fish, xonsh are also supported at the time of this writing. ↩︎

— § —

Reply via email

#bestof #dev #fosdem

★ zizmor

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 03 Oct 2025 12:44:21 +0200

♠ I originally heard of zizmor at FOSDEM 2025:

zizmor is a static analysis tool for GitHub Actions. It can find and fix many common security issues in typical GitHub Actions CI/CD setups.

One month later, I adopted it in the most important repos of our company.

A few months later, I added it to the Alpine Linux repositories, and am happily maintaining it there.

Now I use it everywhere, via a git pre-commit hook:

repos:
  - repo: https://github.com/woodruffw/zizmor-pre-commit
    rev: b933184438555436e38621f46ceb0c417cbed400 # frozen: v1.13.0
    hooks:
      - id: zizmor

The project has recently reached a milestone: it has turned one year old. Its adoption, community and feature set have all significantly increased during that time, in a good way.

The goal, impact and spirit of the project are all really great. And I’m sure this is mainly thanks to the initiative and dedication of its author, William Woodruff.

— § —

Reply via email

#alpine-linux #bestof #dev #fosdem #security