Hey HN - ex-GitLab here, building Selora Homes: Professional installation and managed support for Home Assistant.

The idea is to give people the power of HA without needing to maintain it themselves. Most HA enthusiasts are happy to do this for their homes, but don't want to manage HA for parents, friends, etc.

We pre-install a smart hub (miniPC) for each subscriber and we maintain management access on the host via WireGuard, but all traffic is closed by default - remote support requires your approval. You stay admin of your own instance. The host pulls config updates from our public repo (https://gitlab.com/selorahomes/products/selorabox-nix/), and we handle monitoring, troubleshooting, and (soon) automatic updates with health-aware rollbacks.

We're also working on an AI agent that helps maintain configs and suggests automations.

We're an open core company backed by Open Core Ventures. Source code is on GitLab, roadmap is public: https://selorahomes.com/docs/roadmap/

Currently recruiting beta testers in California (Bay Area and SoCal) if you know anyone interested in testing our product!

We ship you a pre-installed miniPC, our installers handle any physical setup required, and we configure remotely so your devices are set up, along with automations, and a dashboard.

You give us honest feedback. If you're interested, book a call with us: https://selorahomes.cal.com/selorahomes/beta-tester-intro

We also have a free version: https://selorahomes.com/pricing

Check out our docs if want to explore by yourself: https://selorahomes.com/docs/

GitLab offers free security checks for opensource projects (https://about.gitlab.com/blog/2018/06/05/gitlab-ultimate-and...). Enabling these checks is as simple as this one-liner (https://docs.gitlab.com/ee/user/application_security/sast/in...):

include: template: SAST.gitlab-ci.yml

Now do the same with Dependency Scanning, Container Scanning, DAST and License Compliance if needed.

Note that Auto-DevOps enables this automatically.

On a general note, I agree with you, Security should be available out of the box for everyone. I created last month this issue for this purpose, feel free to comment or watch it.

GitLab is planning a feature with the ability to use CI/CD pipelines (and so security checks) also for GitHub hosted projects. It is intended to be released in 10.6, according to the current scheduling: https://gitlab.com/gitlab-org/gitlab-ee/issues/3839

Good luck Phill and Max for your new adventure! And thanks for having mentioned https://gemnasium.com as an alternative.

(Hint: Gemnasium founder here) If you like this feature, you may want to try https://gemnasium.com then. We have a lot more advisories in db, for Java, Python, Ruby, PHP and JavaScript. Please feel free if you have any question, I’ll be glad to help!

Hi, Gemnasium founder here. Let me clarify things a bit :) Gemnasium is a paid service for private projects only, and security notifications. It's free for opensource projects. If you don't want to share your github repo with us (and I completely understand that), you can push your files to our API using http requests, or directly our CLI : https//github.com/gemnasium/toolbelt Modern projects use more than one package manager (ie: bower or npm + something else). You don't need to mix tools with gemnasium, we support projects with multiple deps type.

Feel free to contact me if you have any question!

I appreciate the feedback, but you're not really contradicting anything I said.

Most companies have private projects, so you end up having to pay for Gemnasium. And you do have to somehow upload stuff to your service to make use of it.

Like the grandparent, I just want a command-line tool to document updates to NPM modules as part of Git commits.

> Modern projects use more than one package manager

Our projects are very modern indeed, and we use just one package manager per project. Node.js projects use NPM (for server and front end packages), Ruby projects use Rubygems, etc.

Ok, but there's a difference between sharing _all_ your files and just a bunch of non-critical ones (Gemfile, Gemfile.lock, etc.) :)

Agreed. But why do I need to share anything at all when a local command-line program already has all the information (or can gather it from npmjs.com or whatever)?

and https://gemnasium.com (which supports npm as well)

There's also LA-CONF (http://2013.la-conf.org/) in May. It's also in Paris.

I'm personally using https://gemnasium.com, and very happy with it

I'm sorry to mention some RG projects are still "potentially" dangerous: https://gemnasium.com/rubygems We'll do our best to help determining if these projects really need to be updated asap!