jcgl

13 ms·

211.
by jcgl 9mo ago
Do you have any experience self-hosting SourceHut? I’d really like to do so, but I get weak knees every time I look at the docs for it.
212.
by jcgl 9mo ago
That does sound better, but haven't you just made the unlocked seconds stage bootloader functionally equivalent to secure boot keys? Instead of [get released SB keys] -> [boot arbitrary payloads] It becomes [get unlocked second stag
213.
by jcgl 9mo ago
…how do the updates get booted then?
214.
by jcgl 9mo ago
Adding to my comment since it was downvoted: There are two parts of "sending encrypted files": the encryption and the sending. An offline tool (e.g. PGP or age) seems only necessary when you want to decouple the two. After all, yo
215.
by jcgl 9mo ago
Sticking to the use case of serving that 0.1% of users, why can’t a service or other encrypted transport be a solution? Why doesn’t Signal fit the bill for instance?
216.
by jcgl 9mo ago
This does seem wildly overcomplicated. Here is the attestation system they use: https://github.com/in-toto/attestation/blob/main/spec/README... Why not Just(TM) enforce a reproducible build process?
217.
by jcgl 9mo ago
I can’t speak to the GNOME side of things, but I’ve been enjoying global shortcuts on KDE Wayland for years now. No issues to report whatsoever.
218.
by jcgl 9mo ago
802.1x instead of switch ACLs SSSD (Linux) or Active Directory (Windows) or other more custom solutions for dynamic DNS Firewalls rules that use those dynamic DNS names Bonus: the relatively recent RFC 9686 that I hope will get some good tr
219.
by jcgl 9mo ago
Common practice is to block no finer than /64s. If you treat an IPv6 /64 like an IPv4 /32, you should be off to the races.
220.
by jcgl 9mo ago
No, it’s not—IPv6 networks are totally capable of providing IPv4 as a service. SIIT-DC, 464XLAT, MAP-T
221.
by jcgl 9mo ago
I like RSS Guard a lot on desktop. It’s reasonably featureful, while being snappy and having options to slim down the interface. https://github.com/martinrotter/rssguard
222.
by jcgl 10mo ago
I agree with your general point, but Postel’s law definitely isn’t as universally accepted now as in 2005. Obviously its applicability is totally context-dependent. But I would say that there’s a trend to having smaller systems which are st
223.
by jcgl 10mo ago
> Yes, Go can hardly be called statically typed, when they use the empty interface everywhere. How often are you using any / interface {} ? Yes, sometimes it's the correct solution to a problem, but it's really not that c
224.
by jcgl 10mo ago
I didn't realize you were behind SSLBoard. I think you should've disclaimed that involvement at the beginning. I see now that it's in your bio, but disclaiming is still on you.
225.
by jcgl 10mo ago
> Can you share how they make ACME client configuration easier? It's not a profound difference, but you don't need to add each name to your config. Depending on the team's tooling and processes, that may be inconsequential
226.
by jcgl 10mo ago
I'd say that load balancers (one-address-to-N-servers) count as a common practice, but I otherwise agree in that regard. Regarding wildcard certs, eh. I wouldn't say they have a bad reputation. Sure, greater blast radius. But some
227.
by jcgl 10mo ago
That's exactly my point. Is that while this service sounds quite useful for many common cases, it's going to fail in cases where there's not a 1-to-1 certificate-to-server mapping. Even outside of wildcards, you have to accou
228.
by jcgl 10mo ago
Looks like it relies on certificate transparency logs. That means that it won’t be monitor endpoints using wildcard certs. Best thing it could do would be to alert when a wildcard cert is expiring without a renewed cert having been issued.
229.
by jcgl 10mo ago
Maybe for nerds! But normies won't, can't, and shouldn't manage their own keys.
230.
by jcgl 10mo ago
Human-readability isn't a feature of ASCII though. It's a feature of any encoding for which the user has sufficient tooling. Sure, that's an easier bar to clear for ASCII than for binary formats in general. But as I said, as
231.
by jcgl 10mo ago
Absolutely. For example, if I use specific SSH keys for specific hosts.
232.
by jcgl 10mo ago
This doesn’t track for me. How can text have lower bandwidth but higher meaning-per-bit? How does that jibe with entropy resistance (in an information theoretic sense)? Text seems worse to me. First of all, binary encodings are a superset o
233.
by jcgl 10mo ago
…the public?
234.
by jcgl 10mo ago
Here’s his original blog post from 2016: https://signal.org/blog/the-ecosystem-is-moving/ I go back and re-read this pretty much every time a decentralized thing has problems. It rings true.
235.
by jcgl 10mo ago
That's interesting. I'm surprised. Just some cursory websearching and didn't see anything that gave a solution here for DNF at least. Funky! Seems like there should be a way to deal with this.
236.
by jcgl 10mo ago
> love your blog, thanks for the link. Thank you! Configuring configuration via env var is a good historical example. I think that especially works nicely when you Buy An Operating System. You know, one that is created and provided by A
237.
by jcgl 10mo ago
Other than logging (journald is one of the few truly core systemd components), these are all basically independent programs chosen by your distro. As such, each is best evaluated independently. Let's give it an honest shot: - resolv.co
238.
by jcgl 10mo ago
Okay yeah, sure. So it's not intrinsically more reliable or anything, it's just not specifically vulnerable to LD_PRELOAD. And it's not clear to me why LD_PRELOAD would be a particularly interesting attack vector, but maybe t
239.
by jcgl 10mo ago
> Try installing kde and gnome, then uninstalling both and check how many packages remain. Sounds like a package manager or package problem. Competent package managers (e.g. dnf) remove unneeded packages and all their owned files. Albeit
240.
by jcgl 10mo ago
Those additional programs can be freely chosen by distros and/or users. So each of them has to stand on their merit. Though of course they do get some built-in credibility by coming from the systemd project. But for the most part, I th

More ›