[{"data":1,"prerenderedAt":256},["ShallowReactive",2],{"project-44328405":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":41,"post_text":44,"what":45,"said":90,"maker_in_thread":168,"shape":177,"grid":181,"attempts":217,"same_week":218,"maker_shows":42,"maker_hidden":248,"reader_version":249,"card":250},"44328405","SecureBuild","Zero-CVE Images That Pay OSS Projects","title","Show HN: SecureBuild – Zero-CVE Images That Pay OSS Projects","https:\u002F\u002Fsecurebuild.com","securebuild.com","grantlmiller",1750431871,2025,40,17,1434,3837,38,"shown","web_saas","container images for software vendors","web_app",[24,25,26,27],"zero-cve container images","open source funding","wolfi images","software supply chain security","curious",-0.106,{"positive":31,"neutral":32,"mixed":33,"critical":34},1,8,0,2,11,{"idea":37,"execution":38,"docs":39,"design":40},{"positive":33,"critical":31},{"positive":31,"critical":31},{"positive":33,"critical":33},{"positive":33,"critical":33},[31,33,42,42,42,42,33,31,33,33,42,43,42,42,33,42,33],3,5,"We're launching SecureBuild: https:\u002F\u002Fsecurebuild.com — a new way for open source projects and maintainers to earn revenue by partnering with and endorsing our Zero-CVE container images of their project.\n\nWe’ve spent the last decade at Replicated (https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=9841243) helping commercial and open source software vendors securely distribute their apps to enterprise environments. During that time, we saw firsthand how hard it is for maintainers to fund their work, and how increasingly demanding enterprises have become when it comes to demonstrable security and scanning.\n\nS",{"problem":46,"audience":52,"pricing":59,"motivation":63,"time_to_build":67,"stack":68,"openness":87,"stage":88,"team_size":89},{"value":47,"source":48,"evidence":49},"Open source maintainers struggle to fund their work, and enterprises demand demonstrable security and fast CVE fixes","maker",[50],{"id":51},"post",{"value":53,"source":48,"evidence":54},"Open source maintainers and ISVs distributing software into enterprise self-hosted environments",[55,56],{"id":51},{"id":57,"by":11,"text":58},"44330767","well... our core users are ISVs (who distribute commercial software into enterprise controlled, self-hosted environments... think big banks, governments, tech companies). They…",{"value":60,"source":48,"evidence":61},"Revenue share: 70% of direct subscription revenue returned to open source projects",[62],{"id":51},{"value":64,"source":48,"evidence":65},"Make open source projects more secure and economically sustainable, based on experience at Replicated",[66],{"id":51},null,[69,73,81],{"value":70,"source":48,"evidence":71},"Wolfi",[72],{"id":51},{"value":74,"source":75,"evidence":76},"melange","commenter",[77],{"id":78,"by":79,"text":80},"44341418","marcc","Adding images involves us creating a new package (APK) in our APK repo. This is done by creating a melange build config (https:\u002F\u002Fgithub.com\u002Fchainguard-dev\u002Fmelange). The melange…",{"value":82,"source":75,"evidence":83},"apko",[84],{"id":85,"by":79,"text":86},"44329605","We work together on it. Assuming you have a build process and dockerfile (we all do), generally our team can get you listed in the catalog quickly. It's not too much work since…","unknown","launched","company",{"praise":91,"objections":99,"requests":125,"questions":135,"alternatives":159},[92],{"value":93,"source":75,"evidence":94},"Revenue sharing model addresses maintainer funding problem",[95],{"id":96,"by":97,"text":98},"44329283","dhorthy","this looks cool - your homepage video should open with what it is though!",[100,110,117],{"value":101,"source":75,"evidence":102},"CVE-speed focus misses what matters; prioritize actively exploited vulnerabilities",[103,107],{"id":104,"by":105,"text":106},"44330650","mike_d","> I've seen most auditors mandate 30 days for Critical, but you clearly want to move a lot quicker than that. You seem to fundamentally not understand security. A proper security…",{"id":108,"by":105,"text":109},"44331072","It can be true for you if your correct your thinking on the problem. CVEs are basically just bugs that are not triggered by normal operation. If you race to \"fix\" them all, you…",{"value":111,"source":75,"evidence":112},"Criticism that the 6-day critical SLA is unusually aggressive versus the 48-hour norm",[113],{"id":114,"by":115,"text":116},"44330092","cube00","> New SecureBuilds are created whenever upstream CVEs are available, with a 6-day SLA for critical vulnerabilities. Aren't most SecOps pushing 48 hours as the absolute limit for…",{"value":118,"source":75,"evidence":119},"Homepage messaging unclear about what the product does",[120,121],{"id":96,"by":97,"text":98},{"id":122,"by":123,"text":124},"44336714","justinludwig","More about what you actually do -- I'd suggest something like \"Secure, Sustainable Open Source: We partner with open source projects to monitor their upstream dependencies for…",[126,131],{"value":127,"source":75,"evidence":128},"Clearer homepage copy describing what the service does",[129,130],{"id":96,"by":97,"text":98},{"id":122,"by":123,"text":124},{"value":132,"source":75,"evidence":133},"Correct the wording: new builds are cut for upstream CVE fixes, not CVEs",[134],{"id":122,"by":123,"text":124},[136,144,152],{"value":137,"source":75,"evidence":138},"What is the process to add new images and how are they tested",[139,143],{"id":140,"by":141,"text":142},"44340366","westwater","What's the process to add new images? I assume this is limited to CVEs in the underlying layers, and adding in the latest of the primary package. Given that how\u002Fare you testing…",{"id":78,"by":79,"text":80},{"value":145,"source":75,"evidence":146},"What is the onboarding process for maintainers with existing Dockerfiles",[147,151],{"id":148,"by":149,"text":150},"44329574","siggy","thanks for sharing. what's the onboarding process look like? if i'm maintaining my own Dockerfiles today, do you or I evaluate and port those to SecureBuild\u002FWolfi?",{"id":85,"by":79,"text":86},{"value":153,"source":75,"evidence":154},"How does this compare with IronBank",[155],{"id":156,"by":157,"text":158},"44362273","sheepybloke","How does this compare with something like IronBank? Looks like that could be a great partnership!",[160,164],{"value":161,"source":75,"evidence":162},"IronBank",[163],{"id":156,"by":157,"text":158},{"value":165,"source":75,"evidence":166},"Chainguard images",[167],{"id":78,"by":79,"text":80},{"comments":43,"answered":31,"key":169},[170,171,174],{"id":57,"text":58},{"id":172,"text":173},"44330482","the goal is going to be 6 hours!",{"id":175,"text":176},"44330780","We’d love for this to be true... most images fill up with CVEs so fast in dependencies, we’re providing minimal images (much less surface area) and have the automation to rebuild…",{"commenters":178,"max_depth":43,"maker_replies":43,"first_comment_mins":179,"lifespan_hours":180},10,78,83,[182,186,188,190,191,192,194,196,198,200,202,204,206,209,211,214,215],[183,33,31,184,185,33],"44330669","project\u002Fcritical\u002Fidea","jenny91",[57,33,33,187,11,31],"commenter\u002Fneutral\u002Fidea",[140,31,42,189,141,33],"project\u002Fneutral\u002Fexecution",[78,31,42,189,79,33],[114,34,42,189,115,33],[193,34,42,189,79,33],"44330331",[172,34,33,195,11,31],"project\u002Fpositive\u002Fperformance",[104,34,31,197,105,33],"project\u002Fcritical\u002Fexecution",[175,34,33,199,11,31],"commenter\u002Fneutral\u002Fexecution",[108,34,33,201,105,33],"commenter\u002Fcritical\u002Fidea",[148,42,42,203,149,33],"project\u002Fneutral\u002Fdocs",[85,42,43,205,79,33],"project\u002Fpositive\u002Fexecution",[156,207,42,208,157,33],4,"project\u002Fneutral\u002Fnone",[96,43,42,210,97,33],"project\u002Fneutral\u002Fdesign",[212,43,33,213,11,31],"44329347","maker\u002Fneutral\u002Fdocs",[122,43,42,203,123,33],[216,43,33,213,11,31],"44337474",[],[219,224,229,234,239,243],{"id":220,"name":221,"points":222,"category":223},"44323253","ExTracker",394,"infrastructure",{"id":225,"name":226,"points":227,"category":228},"44329457","Nxtscape",314,"productivity",{"id":230,"name":231,"points":232,"category":233},"44351028","Lego Island (isle-portable)",263,"games",{"id":235,"name":236,"points":237,"category":238},"44317012","Claude Code Usage Monitor",245,"dev_tools",{"id":240,"name":241,"points":242,"category":228},"44375761","Scream to Unlock",242,{"id":244,"name":245,"points":246,"category":247},"44318588","rou2exOS",207,"other",false,"v2",{"id":251,"name":5,"line":6,"ai":248,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":252,"top":18,"kw":253,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":254,"url":9,"mix":255,"praise":93,"objection":101,"sub":21},44328405,-0.11,[24,25,26,27],"10333301003533030",[31,32,33,34],1793991123783]