antocv

53 ms·

541.
by antocv 12y ago
I guess youll find less of complex/large applications built with a tool with specific purpose to be minimal and simple. If anything, Flask is used as part of something larger, but its then not really complex, as that is not a goal for
542.
by antocv 12y ago
That example looked like it would be hell to write from the tip of the tounge.
543.
by antocv 12y ago
Much web scale
544.
by antocv 12y ago
Is this a joke? The standard node.js joke but more disguised?
545.
by antocv 12y ago
You can make an integer range like 2..15 if you know thats your possible input values, and nothing else, only that will be accepted - no need to parse it yourself or check for upper/lower-bounds/unsigned-ness, the compiler and lat
546.
by antocv 12y ago
GNU/Linux and ssh is already secure enough for that. File permissions, so they cant see your files.
547.
by antocv 12y ago
> This allows you to have a single ssh process on the normal ssh port which places user sessions into their own individual docker containers in a secure and locked down manner. No! Warning! Docker is not secure and locked down. Do not us
548.
by antocv 12y ago
Oh this is juuuust great. /sarcasm. So now docker is taking on the work of what systemd and other daemon-managers are supposed to solve? Looking forward to docker run --restart on-failure ubuntu /bin/bash exit -1 When you inc
549.
by antocv 12y ago
China and USA are the same kind of democracy.
550.
by antocv 12y ago
Its the looks and all the small animations or lack of in many places all over work environment. KDE is blasting away any other "user interface shell". If looks didnt matter, stop shaving and getting haircuts, and other pruning act
551.
by antocv 12y ago
I tried it a few months ago and liked it, but the android app wasnt ready. And I didnt like that I couldnt save the songs I listened to any the device that I listened to them on - like a simple local cache. Whats the big deal with adding a
552.
by antocv 12y ago
Yeah, thats just my observation. Big deal, Apple fanboys / Objective-C people earn the most and are in highest demand still. Microsoft is downhill because anything with clouds or servers is none of their business.
553.
by antocv 12y ago
Ive already noticed Microsoft people get fewer job offers compared to Java (enterprise not Android) people. And they have lower salary. The only thing keeping Microsoft afloat right now is the contracts with the state or municipalities.
554.
by antocv 12y ago
Certainly! But its not yet there, mbox is closest - as it can intercept any socket syscalls from a process, and then choose to deny based on the socket syscall arguments. Firejail could do the same, as it also has seccomp filters. Firejail
555.
by antocv 12y ago
wow, very interesting. Thanks! Looks like mbox doesnt use file system namespaces to isolate a process from fs, but instead combines seccomp and ptrace. Hm, Ill try to use this to record a programs interactions with the network, tcpdump list
556.
by antocv 12y ago
Yes indeed. Firejail adds easy seccomp - right now only about 4-5 syscalls are blacklisted, but it would be gravy to specify a whitelist of syscalls and arguments on the command line to firejail. Other security improvments to do is to run w
557.
by antocv 12y ago
This is nice for example, just firejail --seccomp --private --profile your_profile bash and then run your more-secure rtorrent "session". If rtorrent is breached, say buffer overflow/string format, the exploit would not have
558.
Firejail – Simple Linux sandbox with seccomp(l3net.wordpress.com)
62 points by antocv 12y ago|10 comments
559.
by antocv 12y ago
If noone else steps up to it, Ill do it myself.
560.
by antocv 12y ago
I like systemdnspawn much more than docker. Thanks. But ubuntu is still anti systemd, garh.
561.
by antocv 12y ago
We can make it better. SystemDs containers just need a registry of them tarballed. Or lxc expanded with a registry/easy to copy root fs.
562.
by antocv 12y ago
I ran into dm issues too, something with grsecurity stopping a bruteforce. Oh and that ADD this /that will chown 0:0 that. Come on.
563.
by antocv 12y ago
Because its used by the applications Id like to contain fully, you know, for all the purposes containers are supposed to be awesome? In this scenario I dont control the dns server and the app reeally likes aliases instead of IPs.
564.
by antocv 12y ago
Its not the same thing, containments and virtualizations. Abit like comparing apples to oranges. Security wise KVM beats docker out. I like lxc and systemds machinectl containers. But docker dissapointed me. It fails to be a full container.
565.
by antocv 12y ago
Yes I have ran that command, I have docker registry running, then I wanted to clean that port and so I put nginx infront and let it proxypass... and have a onename alias for the host that serves the registry so its used by all the machines.
566.
Ask HN: Is it just me or why does Docker suck so much?
97 points by antocv 12y ago|84 comments
567.
by antocv 12y ago
Sending spam and scam mails?
568.
by antocv 12y ago
Wasnt the faster-than-light neutrino myster solved? It was an optical cable not plugged in all the way.
569.
by antocv 12y ago
> The more I look at this, the more I am becoming convinced that Ukraine was a retaliation for Snowden getting a shelter in Russia. That, but mostly because Russia stopped USA from bombing Syria. Remember when USA really really wanted to
570.
by antocv 12y ago
Yeah, but the new company will be 100% owned by Digia. So basically this is a nice move from Digia to consolidate its ownership and leadership of Qt. I guess its similar to what Google does.

More ›