arianvanp

6 ms·

91.
by arianvanp 11mo ago
Previous version was in bash. With this change you can build a nixos image not containing bash or any shell whatsoever. Not having interpreted languages on the system at all is an effective hardening technique combined with verity store con
92.
by arianvanp 11mo ago
They do have and apparently the scale of the repo is actively breaking things: https://discourse.nixos.org/t/nixpkgs-core-team-update-2025-...
93.
by arianvanp 11mo ago
It's just incomplete and very early days for landlock. Landlock requires you to commit upfront to what is "deny-default"ed but they only added a control for TCP socket bind and nothing else. So you can "default-deny&quot
94.
by arianvanp 11mo ago
There is nothing to do here. Landlock already a guarantees that you can't undo rules that were already applied. Your application can further restrict itself but it can't unrestrict itself.
95.
by arianvanp 11mo ago
It's not the job of a university to prepare you for the workplace. That's the job of the workplace. I'm sick of industry outsourcing their jobs to public institutions. It's the job of a university to teach cutting edge r
96.
by arianvanp 11mo ago
Well I guess at the time large part of GHC development technically was Microsoft Research ;) . But yeh the Functional Programming and Compilers course were nice exceptions to the Microsoft trend. That's also why I ended up following th
97.
by arianvanp 11mo ago
And it should've been NixOS after! It did slowly sneak in over time I guess. In my last year of my master's eventually the faculty was forced to stop hosting its own intranet and mailing lists and migrate everything to the "
98.
by arianvanp 11mo ago
I studied at Utrecht University and all the programming classes in the Bachelor were C#, Visual Studio, XNA, DirectX. Windows. Database class i had to learn in Proprietary Microsoft tools too. All Microsoft stuff. Sure nobody would complai
99.
by arianvanp 11mo ago
Okay so this is just the `apropos` and `whatis` command¥ to search through available man pages. Then `man` command to discover how the tools work. Followed by tool execution? Really. We should be treating Claude code more like a shell sessi
100.
by arianvanp 11mo ago
https://romailler.ch/project/eddsa-fault/ I think this can be solved by using hedged eddsa (Signal does this)
101.
by arianvanp 11mo ago
Yep that's what I do! I have two ssh-ca's stored on two Yubikeys. And both are trusted by my servers. If I lose one I can still sign new certs with the other. https://github.com/arianvp/nixos-stuff/blob&
102.
by arianvanp 11mo ago
Only supports NIST curves and ECDSA yes. I've heard people make the point before that EdDSA is not great for secure enclaves due to being suspictable to Fault Attacks which could lead to (partial) key extraction
103.
by arianvanp 11mo ago
I think this is an openssh limitation. openssh only supports sk-ecdsa-sha2-nistp256 and sk-ed25519 security keys iirc
104.
by arianvanp 11mo ago
The export operation is guarded by TouchID. So the malware needs to trick you into performing the TouchID gesture. But yeh the malware only needs to trick you to hit TouchID once. Instead of on each sign operation. So if that's in your
105.
by arianvanp 11mo ago
These aren't synced over iCloud What you're thinking of are Passkeys. Which are synced. Somebody would have to write an SecurityKeyProvider that talks to the Passkey API instead. Actually I don't think it's completely
106.
by arianvanp 11mo ago
Why is it more secure: a key file on disk is decrypted into memory every time you enter your passphrase. It means the key is around in plain text in the memory of ssh or ssh-agent. Which means it's extractable by an attacker. An export
107.
by arianvanp 11mo ago
The key is stored encrypted with a unique symmetric key that only your secure enclave knows until the point that you export it. It then re-encrypts it with the password. Until you export it it's just as strong as an enclave-generated
108.
by arianvanp 11mo ago
Check out `man sc_auth`. There's also an exportable variant where the private key is encrypted using the secure enclave as opposed to generated on the secure enclave: % sc_auth create-ctk-identity -l ssh-exportable -k p-256 -t bi
109.
Native Secure Enclave backed SSH keys on macOS(gist.github.com)
459 points by arianvanp 11mo ago|192 comments
110.
by arianvanp 11mo ago
Yes. It's great. Especially paired with nix-darwin which allows you to declaratively manage all your macos settings too
111.
by arianvanp 11mo ago
Won't happen. HDMI 2.0 only. This is due to HDMI forum blocking open source implementation in the Linux kernel with lawyers citing security risk
112.
by arianvanp 11mo ago
Does it really matter? Both tourism and business fall under the same ESTA Visa Waiver programme. In both cases you have people visiting without any visa but just an online application at cpb. I dont even think they stamp passports anymore d
113.
by arianvanp 11mo ago
Sweden* Non of this is public in Germany or Netherlands
114.
by arianvanp 1y ago
The way network Access works really feels weird to me. I wish that instead i could just do it like (or with!) nix. If i know the hash of the thing I'm fetching from the network, allow me access to it. Instead of arbitrarily allow list
115.
by arianvanp 1y ago
You can't enable or disable AWS Cloud Trail as far I know? You can enable the persistent storage of trails. But you can always access 90 days of events regardless of that being enabled
116.
by arianvanp 1y ago
Yes ASRock Rack has socketed bios and BMC flash. At least on their Ampere motherboards
117.
by arianvanp 1y ago
Literally exists. importctl pull-tar https://example.com/image.tar.gz && portablectl attach image
118.
by arianvanp 1y ago
Trusted publishing helps with tracking down how something got compromised after compromise. It doesn't do anything to protect against compromise except for using time-limited credentials but that only makes the window smaller. It doesn
119.
by arianvanp 1y ago
Okay but hear me out If we teach systemd socket activation to do TLS handshakes we can completely offload TLS encryption to the kernel (and network devices) and you get all of this for free. It's actually not a crazy idea in the world
120.
by arianvanp 1y ago
People who install zed are switching. I don't understand what you're trying to "get" at. You're complaining about people talking about Zed in a topic about Zed. Zed seems to have been hugely succesful recently and t

More ›