Did a similar thing when we needed to do complex operations towards aws.
Instead of wrapping the aws cli command I wrote small Go applications using the boto3 library.
Removed the headaches when passing in complex params, parsing output and and also made the logic portable as we need to do the builds on different platforms (Windows, Linux and macOS).
The last part missing is "build a flawed product and bake it into the contract so you charge high consultant costs to the customer to fix it" which is where the cash cow is for many enterprise / B2G products.
I would like to say thank you for posting this, I am currently building a similar toolkit in Lua and will most likely restart and just port your code instead :)
The big cost is the upfront cost of insulation and removal the existing heating systems.
Speaking about the UK (article is mostly about he US which will have their own problems), we have very poor quality housing stock with effectively zero insulation. You hold your hand to the exterior walls of your typical 2-3 bedroom terrace house (the most common type of home in the UK) in the winter and its just ice cold. For these homes the exterior wall are just solid brick and plaster with no air gaps. Many homes still don't have double glazing and their windows bleed even more heat. These homes go cold quickly when you turn off a gas boiler, and a heat pump just cannot keep up with the heat loss.
In addition large numbers of households in the UK have migrated to "combiboilers" heating systems that dispensed with hot water tanks for on demand hot water from their gas boiler. In the process many of these properties have converted the space previously designated for hot water storage to loft extensions or other home upgrades. UK homes are pretty small, and going to a heat pump system means going back to hot water storage, which most UK homes have no space for without costly changes to the home layout/structure potentially including sacrificing parts of precious loft conversions.
Frankly we might be better off just knocking down and rebuilding some of our housing stock at higher densities such is the cost of retrofitting and our housing shortages, but there is no political appetite in the UK for any radical solutions like that.
Beautiful houses with period features, in a great location. Big, traditional sash windows that let in loads of light. An L-shaped layout giving lots of natural light in all rooms. High ceilings. Market price about £2 million https://www.rightmove.co.uk/properties/139018139#/?channel=R... (admittedly being in London pushes prices up a lot - but the point is, these are desirable properties)
The walls are all solid brick, no cavity and no insulation. The L shaped layout means a lot of external wall area, and the big windows don't help either. High ceilings make it even harder to heat. Many of these properties are prone to damp problems if they don't get enough fresh air circulating. You can't add external insulation without covering up the period features. Obviously you can insulate the loft and install double glazing - most of them will already have done so.
It turns out nobody wants a £2000/year heating bill - but also, nobody wants to knock down and rebuild a £2M house over a £2000/year heating bill.
Exactly, that housing is super desirable by UK standards - probably amoung the most desirable housing in the UK. Pretty much all of those houses will have loft conversions (you can see the loft windows in the roof) made possible in part by removing their hot water tanks.
The reality is that it is actually a bit shit. and would cost tens of thousands to retrofit. The compromises that the owners would have to make in terms of either apperance or internal area make heat pumps very unattractive.
When you're sitting on a property valued at a couple millions, I would have thought investing tens of thousands in it would be fair game. Not pleasant, but acceptable...
Well one thing is there is often a pretty big disconnect between the asset prices of these homes and the incomes of the current owners (these houses have exploded in value over the past 40 years), but setting that aside because you are basically right at least in terms of potential equity:
The main issue is to add insultation you either do exterior insulation which covers up all of the period features that make the property valuable in the first place (and could lead to complaints from neighbours) and for many terrace houses the space between the front of property and the public street is 0, or you give up interior floor space which even at this price point is actually pretty small already. Both lower the value of the home which for most British people is the primary and often only investment (UK financialisation of housing).
The thing is, heat pumps aren't a particularly good deal right now.
Heat pumps generally have less heat output than a gas boiler, so it won't make your house any warmer.
Even taking government subsidies into account, the installation costs are several times higher than a gas boiler, both for the unit and often requiring new radiators and suchlike.
And typical energy prices in the UK might be 6.5p/kWh for gas, 26.0p/kWh for electricity - so even if your heat pump achieves a 3.0 CoP your running costs are still higher. In the UK, the months when you'll want the most heating are the months when domestic solar output will be at its lowest. To make savings you've got to switch to a plan where electricity costs change several times a day, such as https://octopus.energy/smart/cosy-octopus/ and not run your heating between 16:00 - 19:00. This makes a well-insulated home even more important.
And you might think you're going to save money by not paying the gas supply 'standing charge' - but gas suppliers can charge whatever they like to remove your meter. If they say it's £1500 to remove your gas meter and save you 30p/day - you're probably not going to be saving 30p/day
So it's less a case of "investing" in the house, and more a case of "investing" in good karma by helping the environment.
How much heat do you need? We've renovated a row house in the Netherlands - very similar climate - with solid foam insulation and triple glazing. Haven't gotten to installing a heating system yet. Even in the current cold period it's perfectly fine indoors with a cheap hoodie on. If I didn't know it would make the place unsaleable, I'd be tempted to move forward without any room heating system at all, only a small on-demand water heater.
Nice. Who's your supplier and what do you have to do to get those rates? The 6.5p/kWh for gas, 26.0p/kWh for electricity figures are from my Ovo bill for this month.
> The walls are all solid brick, no cavity and no insulation.
How do you know that? Perhaps just from "Victorian", but I think it would help if estate agents were required to list some basic facts about the house — the year it was built, the basic materials for the walls and roof, the type of heating installed.
He knows that in the same way that all British people know that - we have lived in or know people that have lived in houses that look exactly like that house. The amount of uniformity to British housing stock can be surprising as much as their general shoddiness. Try playing UK geoguesser - every UK residential street looks the same.
There are actually very few enforced rules about house listings. The market is pretty unregulated. However that house has an epc of C which would suggest its not insulated beyond maybe roof insulation or else isn't well insulated. To get a B or above you need to have a reasonable amount of insulation that you mostly only see in new build properties.
Glad you asked! For a start, as you say, it's Victorian.
For further confirmation, zoom in on the buildings with exposed red bricks and you'll see they're in a Flemish bond pattern, which only appears on solid walls. It's not new enough to have a fake Flemish bond pattern for decorative purposes.
You can also see at roof level, the party wall extends above the slates. Where it's unpainted, it's visibly two bricks thick.
If you can get into the house, you can usually tell from how thick the walls are. On houses with cavity walls, sometimes you can remove the skirting board going through an external door and look into the cavity.
You can also check externally for weep holes, the telltale signs of cavity insulation having been installed, and whether there's a damp proof course.
If you have friends in the area, they'll probably be able to tell you. If you get a survey done (which might be reasonable on a house of this age) they'll probably also be able to tell you. Often the homeowner will know too.
If you get cavity wall insulation installed, they'll drill a hole in the wall to check the cavity with a borescope and take a photo. It's a condition for getting the government grant that they confirm you don't already have cavity wall insulation.
> I think it would help if estate agents were required to list some basic facts about the house — the year it was built, the basic materials for the walls and roof, the type of heating installed.
If you check the 'energy performance certificate' (EPC) it should tell you about the insulation and heating. Of course, the qualifications to do EPCs are minimal so they don't really tell you any more than you can figure out from a house viewing. And estate agents often don't deign to produce the EPC until the house is already sold.
The EPC has the overview I was expecting. I had expected this to be linked from the estate agent's site, and didn't realise there was a place to search for them. (I no longer live in Britain.)
Two small things there - not trying to take away from your main point.
(1) This is what Americans would call a "row house", and IIRC in the UK is called "terraced housing", which has the huge benefits for all but the ends of the rows that your side walls (the longest walls of the house) are insulated by ... your neighbor's house. So, although the architectural features you mention are indeed drawbacks, their impact is significantly reduced by being in a row of connected houses. It's the single-family/full-detached houses that suffer from these problems more fully.
For this specific case it's a bit less clear because the house has been extended significantly and so the ground floor floor plan is no longer L-shaped, but if you check the floor plan for the first floor (UK terminology) you can see that the rear-facing square-shaped bedroom has a window facing into the garden, making the overall floor plan an L. The shared walls with the neighbours match up about with the second floor floor plan's extreme left and right edges.
The original design on these Victorian terraces is typically an L shape, where the upright of the L had the kitchen in it, and the base of the L is the main block of the house. This allows the room at the back of the main block to have a window facing back into the garden for light. Many have subsequently been extended for extra space and to add bathrooms, which were not originally present. Partially or completely filling in the corner of the L is popular.
The L comes at the back of the property -- most visible on the first floor of the floor plan linked. Someone's roofed over the side passage on the ground floor to make a bigger kitchen and knocked the two main rooms together to make a larger living room.
That design of terrace is exceptionally common in the UK, where each pair of houses is mirrored, with a kitchen out the back and a side passage letting light into the middle room on each level.
In Poland, some of the houses where historical exterior by law needs to be preserved are insulated from the inside. Of course this eats into the square footage of the building.
I run a building with 5 apartments with central water based wood fire heating, ie a furnace and radiators in various rooms. It's brick construction with no insulation. It's absolutely stupidly constructed.
The central heating is still there and used sometimes, but I installed mini-split reverse cycle air conditioners in each apartment and they work great, you just have to size them (power wise) correctly. They were 550-700 euros each installed. It's much much cheaper to pay for electricity than the equivalent amount of wood, even after the cost of the units. There are various additional benefits like being able to use the aircons when it's briefly cold, or you just want to warm up the space a bit. You also get cooling for no additional charge of course.
Mini split systems are not always the best solution, but they are another useful option to be weighed against larger central heat pump systems. All depends on the situation, but heat pumps are the present and future, nothing else makes sense.
> Frankly we might be better off just knocking down and rebuilding some of our housing stock at higher densities such is the cost of retrofitting and our housing shortages, but there is no political appetite in the UK for any radical solutions like that
Indeed. However a first step would be to put in decent building regs so that sub par new houses aren't being built! Still waiting for the new regs that were originally started in the planning back in 2006 or so.
The fact that new builds are still installing gas boilers and without ventilation systems in 2024 is insanity. A family member just bought a brand new flat that has a gas boiler in it with zero space for a hot water tank and no ventilation. A brand new flat that will need retrofitting within the next 10 years.
I cannot find the source atm, but I recall that the government advice to builders is against installing ventilation systems to discourage retrofitting them in future for air conidtioning, which is makes it even harder to retrofit for heat pumps.
Their thinking is basically if we have mass aircon then our residential energy consumption will skyrocket. New purpose built offices and retail pretty much always have aircon though because they have obvious productivity benefits.
However they also don't encourage passive cooling or low cost active solutions either such have making sure building have pass throughs for airflow, shading of windows, or fan systems. Government seems to be forgetting that current projections have us with Madrid style weather in the next 30 years and we will all be waving our fists.
Yeah, the gov is doing its best to discourage aircon. For example the subsidy on heat pumps can only be claimed if the heat pump can't act as aircon, which is just the problem the US has but in reverse.
Seeing how expensive and drawn-out it seems to be just to get through the permitting process for new construction where I live, I would not favor increased regulation as a first step, but I suppose it would depend on how much of a burden the current standards are in any given area. Some places go as far as to regulate duration of shadows cast upon opposing sidewalks, and some others only seem to see development where sidewalks aren't required, so it seems like various countrys' systems suck all around. Sub-par houses now were not necessarily sub-par houses when they were built, and I'm sure they performed a hell of a lot better than had they not been at all.
A building’s heat loss (the rate of energy needing to be re-added to maintain thermal equilibrium) increases with decreasing outside temperatures and decreases with better insulation.
A heat pump’s max output in heating mode decreases when the outside temperatures are low enough (whereas a gas boiler has a roughly constant max output and it’s quite inexpensive to size a wall-hung combi for 150K BTU/hr [44 kW] if needed).
Buildings that are fine on the coldest design day with a gas boiler may need more output than a heat pump can provide on that day.
Adding insulation can reduce this gap, which is why you’ll often find a heat pump project needs insulation, while a boiler replacement like-for-like would merely benefit from additional insulation.
Yes, gas has been so cheap, until recently, that nobody has invested into insulation, and our housing stock is so poor quality and small in average size that insulation has lots of detractions in terms of property appearance and internal area.
The UK government back in 2010 actually had major plans for nation wide insulation, but famously the prime minster at the time, David Cameron, ordered the cutting of "the green crap" (widely reported to be his words) to help resolve some short term political problems with the budget in the early 2010s.
Heat pumps have a solid max heat output that cannot scale as easily as gas heating. So without insulation they can quickly hit a limit. The upper limit for gas system is limited by how much gas can flow through a pipe, which is a huge amount of energy. The upper limit for a heat pump aystem is set by the compressor capacity, which is in turn set by the electrical circuit, and relative temperatures.
The piece you're missing, beyond just "gas is cheap", is that increasing the heating capacity of a heat pump costs lots of money when installing it, whereas increasing the capacity of a gas boiler isn't much more expensive during installation, but costs loads more when running it.
So technically it would be possible to install a heat pump with the same capacity as the existing gas boiler, but it would costs a ton more and it would all be upfront.
Another detail I think others might have missed, heat pumps need to defrost sometimes, during which time you effectively can't provide heat. In other words, you need to trust the house to be a good enough thermal battery so that you aren't having to continually heat it
The bulk of the cost in the UK seems to be the actual unit. I don't understand why, other than boiler manufacturers trying to maintain the status quo (oversized boilers that can be badly installed by one of the many gas-safe "engineers" already out there).
The split of cavity to solid walls is pretty even in the UK. There are gov grants available for insulation, both for walls and loft. It is true that many houses have moved to a combi-boiler and lost their hot water cylinder but cylinders are smaller than they used to be and personally I would guess the number of converted lofts in these cases is relatively small.
> You hold your hand to the exterior walls of your typical 2-3 bedroom terrace house (the most common type of home in the UK) in the winter and its just ice cold.
The opposite is now becoming more true: with heat waves that seem to occur more often, you want to keep the heat out and the cold in in the summer.
Thankfully insulation tends to work both ways, it keeps warmth in and out.
One of my neighbours redid all the insulation of their house and lowered the high point of the south-facing living room by 10-15C (and made the house much easier to heat in the winter, they can now get by on just the fireplace).
An other good option if you have the space (and money), especially with a south-facing living room, is to add a "sacrificial" sunroom (/ enclosed patio): at the cost of a bit of light, you get extra living space in spring and autumn, and the sunroom will insulate the living room in winter and summer (for the latter especially if it has an opaque roof e.g. tiling).
Yep, now our wall act as raidators in the summers - our homes do not cool down during heat waves because they are radaiting heat collected during the day.
Heating has strong 'follow the crowd' effects: the cost of different options are heavily influenced by what's already commonly used in the local area, because the supply chain will be optimised, and local workers will be most familiar with what's most popular. Bucking the trend in any way sets you up for higher hardware costs and much higher installations and maintenance costs, even if in a different country the same option would be the most economical. (I have experienced the same pain, in a country where most heating is plumbing and radiator based, having a house set up for central air heating and wanting a replacement for the central unit, it was almost the same cost to replace that central unit as it was to rip out the whole thing and replace it with radiators, which is ridiculous on the face of it but a consequence of the supply of parts and labor for each option).
It warms the whole house via floor heating (IIUC it's hot water circulating) and also ventilates almost all rooms (but that seems to be only for keeping the air in the house clean - it "pulls" instead of blowing warm air or something like that).
It cost me a total of 130,000SEK, which is 12,0000 USD (as I write this). Approx. half for the unit and half for installation costs. I don't have the geothermal option where I live because it's a water reserve, but that would be much more expensive, I expect at least twice as much.
I didn't buy a cheap unit, there was a cheaper model that they offered for a total cost of 80,000 SEK... but still, where could've I gotten this for 20,000 SEK :D
I am thinking of the more basic air/air units rather than this air/water.
One well placed air/air can reduce the need for direct electricity heating a lot, even though some might be needed to assist in a bedroom or so.
My parents installed a air/air unit in the middle of the house (180kvm) for $2.5k this summer and it keeps the whole house heated except one bedroom that needs some assistance from a radiator.
That's about the same size as my house... I also have a air-to-air heater but don't even use it because the central heating is more than enough. But interesting to know it could actually manage almost the whole house if I need it!
I have an earlier version of this and they're great, although they use the heater more than the heat pump in winter so bills are cheaper but not miraculously so. The newer versions like your have a bigger compressor, which I think gives them a substantial improvement.
The main problem I've found is now that it's getting old and having problems there's nobody in my area that knows how to maintain them, they only install and then suggest buying a new one when the old one needs new parts, which is frustrating and in line with most white goods these days. So advice for the future is that forums like byggahus.se are good for advice on trouble shooting & parts replacements once it gets old enough to have problems.
I had a Nibe 640P before this. It had broken down almost every year for some 5 years before it finally gave up this year: it started leaking, several parts were not working anymore according to the technician and according to him, they couldn't even buy anymore some of the parts (the machine was only about 15 years old!)... so I didn't have a choice but to replace it... the previous times I fixed it cost me between 4K and 10K SEK (change of some electrical component or sensor that broke, replacement of the actual ventilator a couple of times)... If I could keep fixing it reliably I probably would... but these days, after 15 years every technology changed so much that what you've got becomes a museum piece that can't be fixed. Same thing happened at almost the same time to my alarm system :( Sektor Alarm didn't even offer to fix it up... it was using 2G which apparently is slowly dying in Sweden. At least they got me a very good discount and I spent "only" about 5k SEK to get a very modern alarm system with cameras, vibration sensor, mobile app and bells and whistles :). But again, I'd rather just keep what was working if I could as to me it feels like a huge waste to throw away so many electronic components which are mostly working just fine... however, you just can't do it anymore.
Yep, 15 years was what I was told was the life expectancy of the system and nobody is interested in making them last longer. I try to fix things but as you say, finding spare parts is really difficult.
When I bought the house, it already had floor heating across the entire plan... but from what I see, it's not that hard to DIY if you're so inclined. Specially with floors like are typical in Sweden, it's like laminated flat boards that are easy to replace: https://www.bauhaus.se/hpl-laminatgolv-berryalloc-ek-vitolja...
It looks pretty good too... you need to do some cutouts for the warming pipes underneath, there's lots of Youtube videos showing how :D
But luckily, my floor heating apparently is still in very good condition so it will be a while before I have to replace that.
The floor heating itself isn't that expensive, the problem is you need to redo you floor, which sometimes means destroying it and doing a new install. We wanted a new floor anyway so not a problem, but if you have something expensive it will add up.
If your Samsung heat pump costs 1-2k you can expect the same product from a German company to cost 7-15k for no appreciable difference. Why buy the German product then? Because the builders who install it will get a cut of course. They don't need your business and will simply refuse the job if you don't buy the most expensive materials. You can add to that cost all the subsidies of the German government, which, as everyone knows, simply increase prices when there is a supply shortage. But these subsidies are tied to other requirements to make your house more energy efficient, like installing a solar power system with batteries (30k€ easily).
Heat pumps are a gimmick for rich people that already have well insulated modern homes. For everyone else it is vastly more expensive than gas or oil and in addition, we have to pay taxes for all the subsidies going to those rich people.
I got “away” paying almost exactly €10k for fancier ground-source setup using a 6kW Thermia (i.e. Swedish) heat pump (itself about €6k.) IIRC there were definitely cheaper geothermal options back when I was investigating, but I got sold on the ecology aspects of that particular solution as well.
I can make some comparisons between the two too – ground-source maintains great COP even if its -20°C or less outside (as it was a couple days ago.) The incoming carrier liquid remains comfortably around 5°C, no matter the season. This also enables passive floor-based cooling. With an air-source heat-pump one would need some sort of a reversible cycle setup, I suspect, or perhaps a separate AC, which would likely bring the total cost of an air-source implementation up a little bit further.
It is also no-louder than your modern fridge. My neighbours’ air-source heat pumps’ exterior units were going at it so hard one could have been excused if they mistook there was a busy airport within an earshot. On the other hand if there's already an airport, what does it change if there’re N planes or N+1 planes in it :)
I did not say otherwise :) My point is that with a ground-source the cooling can be “passive” – you don’t actually need to turn on anything but a circulation pump or two once in a while.
The downside of course is that its not going to make your already +40°C room into a flu-inducing +18°C one. Its more of a tool to offset a 2°C, maybe 4°C in extreme cases indoor temperature rise. Which is likely more than plenty for many airtight & insulated houses.
And indeed, managing humidity is hard. If this sounds at all interesting to the reader, definitely research whether this is applicable in your situation/area at all.
Good question. Seems unlikely that the prices are correct. If it is then someone has a huge incentive to import from other places. The most popular air-air heat pump in Norway with a SCOP above 5 is less than 2500 USD including installation and tax.
But, it's also a fact that the US is far behind when it comes to heat pumps and energy efficient homes. The general knowledge in the US about heat pumps is terrible.
I fear you are wrong. I'm American, and can confirm that heat pumps in the US are still very expensive upfront. There are often grant programs that can offset some of the cost, but for whatever reason they are much more expensive here than Europe.
The main issue seems to be that installation is extremely expensive. Less expensive heat pumps are now available here if you are able to do the installation yourself, but installers will only work with the expensive brands they know. They are usually overbooked, and thus have no incentive to lower their prices.
The question would be what it would take to get competition in the market at the installer level. Any idea how this was accomplished in Norway?
> In Sweden the hardware cost around $1k - $2.5k and installation $500 - $1000. It's not a complicated task.
These numbers must be for an air to air mini-split unit with one air handler with nearby electricity, $500-$1000 is 4-8 hours of labor. That’s not nearly enough for an entire home.
A whole house heat pump with heat exchanger costs substantially more, both in equipment and labor.
In Switzerland I was quoted about 25k for an air-water and about 10k more for geothermal. And I mean with it only the hardware and installation - as the house doesn't need piping or whatever. So for some reason you Nordics are quite privileged, and I wasn't able to find out why.
Depends upon the heating system. A cheap air to air, single unit heat pump does not cost much but if you want anything more then it costs more. A lot of houses with a basic heat pump use it to reduce the amount of other heating used and pump hot air into a single area of the house, with additional electric heaters in other rooms and a water heater for hot water.
However to totally replace your entire heating needs with an all-in-one system is much more complicated than that. The heat pump I have alone in Scandinavia costs roughly $6-10k. That's powering water heating in every room plus hot water in the taps, zero additonal heating of air or water required. It's the size of bulky floor to ceiling fridge and does wonders for my electricity bill!
I was quoted around $80k (in central EU) all in for 50KW heating unit. About a third was drilling of silly number of holes (water-water heat pump). Price didn't include updating radiators / installing underfloor heating in the house itself.
If I replaced wood pellet boiler I use right now with a heat pump I'd break even in about 20 years, which is longer than the expected service life of the pump..
Out of curiosity, why did they think 50kW was a necessary amount of energy to heat? Is the building old and poorly insulated? An A/A+ energy class 150m² home barely needs 1/10th that amount.
If it was indeed a question of insulation or airtightness, then perhaps spending a part of that money for renovations in that area and only then a fraction of the price for a reasonably-sized heating unit might be sensible. You could also do just the renovations and thus reduce your wood pellet usage substantially as well – already a big win for the environment.
Almost 800 m^2, 55cm thick red brick walls with OK, but not great insulation, casement windows.
That aside what I wanted to point out is that because of heat pump pricing they are currently not the best choice, economically speaking. It is 6-10x more expensive upfront and won't break even over it's lifetime.
By comparison solar panels break even is 6-8 years and after that they are expected to last 20 more years bringing you 2-3x installation costs in savings over their lifetime.
We're working on porting unl0kr from postmarketOS to Fedora to allow for LUKS on the Steam Deck without an external keyboard, that should also work well for a tablet use case once it's done.
On the topic there are a category of preschools in Sweden called "Ur och skur" which have most education outdoors.
Back in the 90s I know some primary schools in Sweden also had education outside, but I think that have changed with schools becoming more competitive lately.
Having had a quick look through this workflow it seems to miss most opportunities to ensure a safe build.
- Downloads binaries for use in build with no hash/signing verification.
- Doesn't pin shared actions.
- Uses Yarn to install dependencies (which can involve downloading/executing arbitrary code from anywhere)
- Doesn't sign the final binary.
None of this is necessarily wrong, all would make maintenance harder in the long run, but it means this project is really about removing MS branding and some telemetry, and that there is a security trade-off to get those benefits.
> - Downloads binaries for use in build with no hash/signing verification.
It downloads them using TLS.
> - Doesn't pin shared actions.
The shared actions are just @actions/checkout and @actions/setup-node. They're official. I wouldn't pin them - YAGNI.
> - Uses Yarn to install dependencies (which can involve downloading/executing arbitrary code from anywhere)
It downloads/executes code based on the carefully chosen dependencies
> - Doesn't sign the final binary.
That's platform dependent I think. For Mac OS X it does.
Seems like FUD, which you might be able to recognize because you say "None of this is necessarily wrong". Especially the part about pinning first party GitHub Actions. There would be nothing wrong with that but it is much more useful to pin third party GitHub Actions, and IMHO suboptimal to pin first party actions.
Isn't the whole point of this comment thread "vulnerabilities to supply chain attacks"?
>> - Downloads binaries for use in build with no hash/signing verification.
> It downloads them using TLS.
If the binary is updated to a shady version, sure, no one will be able to tamper with the download, they're certain to have received the correct shady stuff.
I don't think it's quite FUD, but I do agree none of these are strictly necessary, all can be rationalised as unnecessary and for many users this project probably provides a perfectly reasonable security posture. However the fact that there's so little explicit acknowledgement of the security concerns, and that 2 minutes looking at the repo turned these things up, suggests that security is not a priority of the project. Again, not the wrong thing to do, but maybe not the trade-offs all users will want.
Pinning actions is so low effort/high reward that even the low risk makes it worth it for a project like this in my opinion. Official actions are certainly much safer, but ultimately it's still just human review and PRs being merged.
Downloading over TLS negates some impact of hash/signing verification, but it would be a nice extra layer. You're otherwise putting a lot of trust in the combination of DNS+CDN+Hosting. I've seen hijacked sites due to IPs being re-used on cloud providers for example. Unlikely, but again easy to do and high impact in the rare situation that is is taken advantage of.
Yarn dependencies may be carefully chosen, I'm not familiar with the VSCode practices. I bet that official binaries however are not built like this – I'd bet that there are allowances for specific network connectivity and binary execution, and that everything else is locked down. To my knowledge GitHub Actions have open internet access. I wouldn't even say this is low risk either, the NPM ecosystem is so deeply nested that I'm sure malicious code could be snuck in somewhere. This is a lot harder to solve for this project, and certainly the most debatable aspect as to whether it's worth it or not.
The yarn.lock includes checksums, if yarn is not checking checksums properly then that affects every project in Node.js, not just this one.
Malicious code with the correct checksum? VSCode team is not auto updating dependencies but I also doubt they are reviewing the source code of every package they update. I've never worked anywhere that does. So yeah, "gulp-vinyl-zip" (or any other package used at build time) could add some code that secretly triggers when run in the VSCode repository and makes some malicious source code changes. But, it's still going to be the same code in VSCode and VSCodium. Unless the attacker decides to use specific logic to target one or the other.
It's possible, and common, for NPM packages to download additional binaries at install and/or run time. These would not be included in the hashes, and are essentially untrusted, often hosted on random S3 buckets. I'd hope there are checks in the official project to ensure these aren't being used, but there aren't any checks in this project.
My employer uses artifactory as a mirror of npm and one step of adding a package to the mirror is installing it on a VM/container with no network access. If the package has a "postinstall" script requiring internet access then it will fail. There's also code scanning that will find at least casual attacks like "download and run this crypto ransomware".
Also, it depends how determined your attacker is. If they write code to detect whether they're being installed in the vscode project, have access to commercially available security scanning tools to ensure they evade detection, etc...
I'm not sure I follow why the "official" actions under the actions org are materially different to others? I agree they're likely to have better processes around contributions, but they are fundamentally an open contribution model with human review, and human review is fallible. Unless they had extra sandboxing, pinning requirements, materially better testing, etc, I'm not sure there's a huge difference.
However, the Linux one grabs two from third party, to GitHub, repos. These seem relatively safe, from official systems level projects — snapcraft and docker. I'm going to suggest to Codium they add a SHA to pin those, just like I would suggest they unpin GitHub Actions if they'd had them pinned. Sorry I was looking at the Mac one because I have a Mac even though the link up the thread was for Linux.
That's the key value of open-source projects. You don't have to release a binary, just source code and a build guide. It's also one of the reasons why I have such high respect for OS distributions like BSDs and Slackware. They give you a good base that you can build upon if you know what you're doing.
The problem is, many PC users don't really know what they're doing.
Can't tell you how many times I've had to explain how environmental variables work to developers, and that's a pretty simple concept compared to many other things in an operating system.
I had an idea for a similar project (1) a few years back, but abandoned it after reaching the state where I had a node module to attach an Electron window to the wallpaper in Windows.
Fun to see a project that has reached further, remember how cool I used to think dashboards/widgets for the PC stats were when I was younger.
In Sweden most government data is public which includes individuals tax records.
That generates things such as news articles "The 50 people in your area that had the highest income last year" with home address and everything and that you can look up income instantly on the web.
Some level of privacy for this would be nice to have.
Instead of wrapping the aws cli command I wrote small Go applications using the boto3 library.
Removed the headaches when passing in complex params, parsing output and and also made the logic portable as we need to do the builds on different platforms (Windows, Linux and macOS).