mac-chaffee

8 ms·

31.
by mac-chaffee 3y ago
I see a lot of "just add more specifics to the rule" in here, but that's fighting a losing battle. There will always be another edge case, and the rule will end up being so long and complicated that no one will properly follo
32.
by mac-chaffee 3y ago
> You can't just purchase a "deluxe cybersecurity firewall appliance" and plug it into your network, even if it costs $50,000 Those cost a quarter of a million per year nowadays...
33.
by mac-chaffee 3y ago
I've been messing around with this for the past week, it's very cool. There's even a CloudFlare Durable Objects-based AppleTalk networking stack, which I think is such an interesting fusion of old and new: https://
34.
by mac-chaffee 3y ago
I hit an unexplained error while migrating, and the error page told me to go to https://help.mojang.com/ which has an expired TLS cert as of today. Then I tried to submit a support ticket here: https://help.minec
35.
by mac-chaffee 3y ago
Since universities were some of the first movers to the internet, there's a lot of legacy stuff holding them back. When you add in the sheer size and the lack of centralized power (which the author has talked about[1]), I'm defini
36.
by mac-chaffee 3y ago
The advice you are getting so far sucks. The default security settings on macOS are easy to bypass: https://www.macchaffee.com/blog/2023/hacking-myself/ Unfortunately these are design weaknesses, so any &quot
37.
by mac-chaffee 4y ago
I just give developers access to k8s and teach them about it. That's really just my admission that the Kubernetes API isn't perfect, but it's better than many alternatives. If I were to build something to hide k8s from develo
38.
by mac-chaffee 4y ago
The Kubernetes API is itself a leaky abstraction over many different concepts. Putting docker-compose over top of that is just an even leakier abstraction. Even their example of using Ingresses is already leaky because there is no similar c
39.
by mac-chaffee 4y ago
Not a lot of people pull by hash; they pull by tag. Tags are not immutable, so the image I get from "python:3.11" today will almost certainly change due to security updates and I will be none the wiser.
40.
by mac-chaffee 4y ago
May want to keep your eye on dragonfly, a P2P image distribution protocol: https://d7y.io/docs/
41.
by mac-chaffee 4y ago
I always reference this post when the subject of self-hosting "simple" things comes up: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/RunningSer...
42.
by mac-chaffee 4y ago
> The results show that rewriting the packets is quite a bit more expensive than just allowing or dropping a packet. For example, if we look at the unidirectional test with 10,000 flows, we see that we dropped from 14M pps [packets per s
43.
by mac-chaffee 4y ago
Kubernetes is only tested against 110 pods per node: https://kubernetes.io/docs/setup/best-practices/cluster-larg... In my testing, it's a limitation in either the container runtime or kubelet in process
44.
by mac-chaffee 4y ago
Oh yeah seems that FETCH_COUNT is special and is not a regular setting. All normal settings that you can SET can also be set per-DB and per-user: https://www.postgresql.org/docs/current/config-setting.html#...
45.
by mac-chaffee 4y ago
By default, psql will fetch the entire result first then print it out. This is usually fine until you need to fetch more rows than your client's RAM. To fix that, you can run "\set FETCH_COUNT 10000". Then psql will use a cur
46.
by mac-chaffee 4y ago
I've been running the OWASP coreruleset in production for about a year now and it has been a big pain. The way I made it manageable was 1) training users that "if you see a 403 error, tell me ASAP" and 2) learning the ModSecu
47.
by mac-chaffee 4y ago
The author admits it's extreme, but is clearly trying to normalize it: > Someone defines Kubernetes as “a well-designed and extensible API with programmable reconciliation logic, that happens to come with a container orchestrator bu
48.
by mac-chaffee 4y ago
Amazon publishing a blog that blatantly argues for vendor lock-in? Who would have guessed? One of the big benefits of Kubernetes is the cloud-agnostic API for running pretty much any application. CustomResources can help blur that boundary
49.
by mac-chaffee 4y ago
Don't use it on macOS. It has no protections at all for cookie theft. Unencrypted SQLite DB sitting in a user-readable directory. Chrome and (I think) Safari both use encryption keys in the secure enclave. That's still not perfect
50.
by mac-chaffee 4y ago
Yep, same with cookies and cloud credentials: https://www.macchaffee.com/blog/2023/hacking-myself/
51.
by mac-chaffee 4y ago
Not sure if this is exactly what the person you replied to is talking about, but I recently looked through a list of tools for restricting the permissions of programs: https://www.macchaffee.com/blog/2023/hacking-m
52.
by mac-chaffee 4y ago
If scientific computing interests any students in the NC triangle area, we're looking for a Fall intern to do some platform engineering: https://unc.peopleadmin.com/postings/247397
53.
by mac-chaffee 4y ago
Is tying session tokens to IPs actually common? I can't imagine it is given the unreliability of IP addresses causing issues. I used to live somewhere where outbound traffic went through one of three CGNAT IPs at random, and I only had
54.
by mac-chaffee 4y ago
> Digital self-storage has gotten more complex as I discovered when I visited the DataHoarder subreddit. Posts there with technical advice for the best home setup were jargon-filled to the point of incomprehension for a newbie. Yeah the
55.
by mac-chaffee 4y ago
They talk about how the federated version is safer due to the long random master password, but... Federated LastPass is tied to your company's SSO, which means your real master password is technically a login.microsoftonline.com (or eq
56.
by mac-chaffee 4y ago
I do wish I knew of a better solution/mitigation. I feel like there might not be anything an individual really can do. It depends on coworkers picking up the slack or leadership/customers just demanding less (hah). I quit my last
57.
by mac-chaffee 4y ago
I think this is the paper they're talking about: https://academic.oup.com/jcr/article/36/2/160/1942726 Interestingly, they did control for the effects of TV that was edited with commercials in
58.
by mac-chaffee 4y ago
Agreed. You really get what you pay for with the managed k8s offerings, and you really can't get a lot of good software for ~$72 per month. Not having to run the control plane is a drop in the ocean of complexity that comes with k8s (n
59.
by mac-chaffee 4y ago
I've been happy with Gitea. It's very fast, and upgrades cannot be simpler. Just download the new binary and start it. The migrations run automatically. If you need a git hosting service but "hosting git" isn't your
60.
by mac-chaffee 4y ago
A large part of any syllabus is a description of the academic integrity policy. Most universities even mention it during orientation. Most all my exams had "by signing, I agree to..." next to where you write your name. Universitie

More ›