matthewlilley

NOTE TO READERS

I did not originate this text. It came from https://board.net/p/r.e6a8f6578787a4cc67d4dc438c6d236e but that has fallen over. This is an archive for readability's sake.

---

11/21/2023

To the Board of Directors of OpenAI:

matthewlilley

FROM node:18-alpine

# Install git and pnpm
RUN apk add --no-cache git libc6-compat grep
RUN npm install -g pnpm@7.18.2 turbo@1.7.0

# Do ARG stuff
ARG SCRIPT_PATH="./"
ENV SCRIPT_PATH ${SCRIPT_PATH}

matthewlilley

FROM node:18-alpine

# Install git and pnpm
RUN apk add --no-cache git libc6-compat grep
RUN npm install -g pnpm@7.18.2 turbo@1.7.0

# Do ARG stuff
ARG SCRIPT_PATH="./"
ENV SCRIPT_PATH ${SCRIPT_PATH}

matthewlilley

FROM node:18-alpine

# Install git and pnpm
RUN apk add --no-cache git libc6-compat grep
RUN npm install -g pnpm@7.18.2 turbo@1.7.0

# Do ARG stuff
ARG SCRIPT_PATH="./"
ENV SCRIPT_PATH ${SCRIPT_PATH}

matthewlilley

# Defining environment
ARG APP_ENV=development

# Building the base image
FROM node:lts-alpine as base
RUN echo "running BASE commands"

# Building the preinstall production image
FROM base as production-preinstall
RUN echo "running production preinstall commands"

matthewlilley

Not all random values are created equal - for security-related code, you need a specific kind of random value.

A summary of this article, if you don't want to read the entire thing:

• Don't use Math.random(). There are extremely few cases where Math.random() is the right answer. Don't use it, unless you've read this entire article, and determined that it's necessary for your case.
• Don't use crypto.getRandomBytes directly. While it's a CSPRNG, it's easy to bias the result when 'transforming' it, such that the output becomes more predictable.
• If you want to generate random tokens or API keys: Use uuid, specifically the uuid.v4() method. Avoid node-uuid - it's not the same package, and doesn't produce reliably secure random values.
• If you want to generate random numbers in a range: Use random-number-csprng.

You should seriously consider reading the entire article, though - it's

matthewlilley

Keybase proof

I hereby claim:

• I am matthewlilley on github.
• I am matthewlilley (https://keybase.io/matthewlilley) on keybase.
• I have a public key ASDhEiPZ358urBPurK8Dzo0_vw9H1wIKL6tcv9wAF7tPywo

To claim this, I am signing this object:

matthewlilley

git clone https://github.com/protocolbuffers/protobuf.git
cd protobuf
git submodule update --init --recursive
./autogen.sh
./configure
make
make check
sudo make install
sudo ldconfig