Foxboron

36 ms·

391.
by Foxboron 6y ago
Funny. I have been working on a blogpost detailing the silly things I encountered while packaging LXD properly for Arch Linux. Should probably finish it up one of these days.
392.
by Foxboron 6y ago
>It's so absurdly complicated. Security. Dynamically linking stuff is always going to be better than statically linking. Do you trust upstream to keep track of security issues and rebuild in the absurd dependency tree that is Golang
393.
by Foxboron 6y ago
That is not really the point. The signatures are embedded in the APK. Repacking it to remove, or add valid signatures, would be a problem.
394.
by Foxboron 6y ago
You would need to repack the .APK, which would be a hurdle in the comparison.
395.
by Foxboron 6y ago
Cool. But neither the audit nor the repository explains if it's possible to create the APK in a reproducible way. Google Play distributed APKs contain their signatures, so in theory it wouldn't be possible to 1:1 reproduce the dis
396.
Why not “Why not WireGuard?”(tailscale.com)
174 points by Foxboron 6y ago|41 comments
397.
by Foxboron 6y ago
I never got around to submitting my blog to HN. But if people are curious about some technical details of the underlying problems of reproducing Arch Linux packages I wrote something a few months ago. https://linderud.dev/bl
398.
by Foxboron 6y ago
>Based on my reading of this Arch wiki page[0], it looks like this doesn't impact packages in the AUR. Yes. AUR is excluded from reproducible builds because it only provides build scripts and not actual packages. There is nothing to
399.
by Foxboron 6y ago
Yes. But a staggering amount of packages in the main [core] repository is still fully reproducible by independent parties if tools are run. https://wiki.archlinux.org/index.php/DeveloperWiki:Reproduci... It's stil
400.
by Foxboron 7y ago
Martin Sandsmark, the CTO, is a KDE developer and long-time Arch Linux community...guy. It's not going away in a future software update :)
401.
by Foxboron 7y ago
It's for viewers to verify the work they are doing. I'm not implying they shouldn't.
402.
by Foxboron 7y ago
>during what was apparently a check on the system on Tuesday night – the day before the ceremony planned for 1300 PST (2100 UTC) Wednesday – IANA staff discovered that they couldn’t open one of the two safes. One of the locking mechanism
403.
by Foxboron 7y ago
Arch Linux also received 300k USD. We didn't publish any news about this as this was a "no-strings attached" donation. You can however see it as part of the monthly SPI reports; http://spi-inc.org/treasurer&#x
404.
by Foxboron 7y ago
It should be noted that the makepkg.conf file distributed with pacman does not contain the same compression settings as the one used to build official packages. pacman: COMPRESSZST=(zstd -c -z -q -) https://git.archlinux
405.
by Foxboron 7y ago
All Arch infra runs on Arch Linux. The infrastructure repository is all open. https://git.archlinux.org/infrastructure.git/ Now, official infra doesn't reach hundreds of days. But personal systems might :)
406.
by Foxboron 7y ago
The kernel doesn't support booting zstd compressed initramfs' yet, but you can very well use zstd compression with dracut and mkinitcpio
407.
by Foxboron 7y ago
Well, that is a bit on a 50/50 coinflip currently. There has been intentions but we need some collaboration from upstream to make this happen. It's not set in stone currently.
408.
Reproducible Builds in November 2019(reproducible-builds.org)
4 points by Foxboron 7y ago|0 comments
409.
by Foxboron 7y ago
I agree with the observation. But the alternatives are grossly over-engineered or a case study in NIH. I'm sticking with Makefiles until someone can present something better. >Something like Bazel theoretically solves this problem,
410.
by Foxboron 7y ago
Let me stress that packaging software and deploying software has two different concerns. Your script might work wonders for deployments and shipping it to your infrastructure. But it might be completely broken if anyone want to package up t
411.
by Foxboron 7y ago
>A Go project should only require the Go compiler to build successfully. But they don't. The go compiler doesn't support yarn, npm, protobuf, open-api generators, doc generators like md2man, go-bindata-assetfs, gox and everythi
412.
by Foxboron 7y ago
2 is loose. 1 is strict.
413.
by Foxboron 7y ago
I'm confused! You write that turning rp_filter to 0 or 1 prevents the attack? While the report says that parts of the attack can't be accomplished. Does it completely prevent the attack, or only parts of it? This isn't clear
414.
by Foxboron 7y ago
It should be noted that setting the rp_filter to either 0 or 1 doesn't mitigate the entire attack. Just parts of it.
415.
Reproducible Arch Linux Packages(linderud.dev)
3 points by Foxboron 7y ago|0 comments
416.
by Foxboron 7y ago
>He is now likely homeless and his friends (such as Eric Raymond) have had trouble contacting him. and as esr wrote: >I guess he was sleeping in his office and can’t anymore. But this hasn't been true for years. >Until around
417.
by Foxboron 7y ago
Funny enough, Cuttles is created by Karen Rustad. She also drew the Ferris logo for Rust.
418.
by Foxboron 7y ago
>A practical solution, IMO, would be several organizations running and publishing the builds—i.e. several independent F-Droids. Then, a few interested people could rather trivially automatically download the binaries and compare them. If
419.
by Foxboron 7y ago
I do! I have 91 windows open in my current irssi session. I think only 50 of those are actual channels and the other half is active or dead queries between people. I use have slack for some group of friends, but I have been less active afte
420.
by Foxboron 7y ago
>First, we'd love it if you would try our early container prototype on your build. Contact us and we'll add you to our closed alpha test. If the code is available; sure. If it's not then sadly this isn't interesting.

More ›