rkeene2

26 ms·

211.
by rkeene2 5y ago
Fossil [0] can sign every commit [1] (with GPG or S/MIME) and have merges performed centrally because it never modifies history. Git can probably also do this for certain merge modes ? I'm not very familiar with how this works in
212.
by rkeene2 5y ago
It hasn't been able to do it in a meaningful way. I've been patching support for this into ssh-agent for about a decade. I wrote a PKCS#11 module which talks to the SSH agent socket to forward your smartcard [0]. Doing so requir
213.
by rkeene2 5y ago
In this vein, I wrote a blog post on writing your first PAM module here [0]. [0] https://rkeene.org/projects/info/wiki/222
214.
by rkeene2 5y ago
I in fact have done this (heavy user of smart cards and author of middleware), BUT what sshd logs (a fingerprint of the public key) requires a bit of work to match an authorized_keys format file (basically a stripped down PKCS#1 format wi
215.
by rkeene2 5y ago
I typically frame this as accounts are for accountability. Reducing accountability isn't typically a goal for organizations so it's strictly better to have 20 accounts with sudo versus everyone using a single shared account (share
216.
by rkeene2 5y ago
This is how the "defer" [0] command (from tcllib) in Tcl works. [0] https://core.tcl-lang.org/tcllib/doc/tcllib-1-19/embedded/ww...
217.
by rkeene2 5y ago
What I miss from Fossil, some of which I've brought up on the Fossil Forum are: 1. Pull Requests ( https://fossil-scm.org/forum/forumpost/01d77b7259ea0b00?t=h ) 2. Code Reviews -- I spend atleast half my time
218.
by rkeene2 5y ago
For one of my projects I use CDK (JS) with a JavaScript project and the CDK part does call limited parts of the project to lookup how many DynamDB tables to create and which kinds of which indexes to generate. Also the API gateway configura
219.
by rkeene2 5y ago
There's a few differences when compared to Apple: They will host your app and let others install it with a private code for free (you don't have to pay to become a developer, and you don't have to pay to use unapproved apps,
220.
by rkeene2 5y ago
I built this a few times. The most current implementation is called CloudSeed, though I am trying to fundraise for an open source version (with a RedHat-like business model of support). CloudSeed has been a key part of several >$1bn con
221.
by rkeene2 5y ago
Most of the YubiKeys support PIV (NIST SP 800-73) mode, which gets you X.509 support (and a PKCS#11 module), which has much broader support than PGP.
222.
by rkeene2 5y ago
Negative responses are cachable with the appropriate time to live from the Start of Authority record for the zone.
223.
by rkeene2 5y ago
This is why I use `-Werror` in maintainer mode but not otherwise.
224.
by rkeene2 5y ago
I usually just do: objdump -x <binary> | grep NEEDED but this is a great tip !
225.
by rkeene2 5y ago
It's also useful if you accidentally chmod -x chmod...
226.
by rkeene2 5y ago
As a sibling comment pointed out this was a reference Homeland Security Presidential Directive 12 (HSPD-12). The results were that the vast majority of systems did not use passwords. You can check out the status over time by googling &quo
227.
by rkeene2 5y ago
Yes, I was referring to HSPD-12 of 27-AUG-2004.
228.
by rkeene2 5y ago
Not everyone has tolerated passwords. US President George W. Bush signed a Presidential Directive directing all parts of the US Government to make and implement plans for getting rid of passwords in August of 2004.
229.
by rkeene2 5y ago
What I do is include the ChangeLog in the tag for the release. I do semi-manually generate the ChangeLog using the titles of the Story/Bug that was merged in for a given PR, and then any commits that were done directly get a special no
230.
by rkeene2 5y ago
Keep in mind this allocation strategy only affects 1/8th of all IPv6 space, so if we picked the wrong one we have the other 7/8ths to use in a (hopefully) better strategy.
231.
by rkeene2 5y ago
You can thank large backbone providers for this. IPv6 works just fine over the same L2 link as IPv4, so there would never need to be any more hops than IPv4 (sometimes they do need to upgrade equipment to support IPv6 so they may be DIFFER
232.
by rkeene2 5y ago
I'm always hesitant to use dlmopen() because of the really low limit on number of namespaces your process gets (IIRC, 16).
233.
by rkeene2 5y ago
Building from tarball has many advantages over building from a VCS, especially a DVCS. The main one is that tarballs are serialized, hash-able, cache-able, mirror-able, checkable objects. Unlike a tag from which some serialized version mu
234.
by rkeene2 5y ago
Shibboleth is terrible -- so terrible it was easier for me to write my own SAML IdP from the specification than try to make it useful. Lots of people use Active Directory Federated Services (ADFS), which has a SAML IdP.
235.
by rkeene2 5y ago
It doesn't achieve the stated goal of rate-limiting individual people, which sounds like an instrumental goal for an actual (unstated) business objective.
236.
by rkeene2 5y ago
One option might be to allow people to view tweets if they have accounts from reputable federated identity providers, then you have an identity of an individual person without having to do the validation yourself. You can then rate-limit b
237.
by rkeene2 5y ago
There previously was such a thing from Mozilla called XMLTerm [0]. You could be the one to revive it ! [0] https://www.xml.com/pub/2000/06/07/xmlterm/index.html
238.
by rkeene2 5y ago
ELVM [0] also has a C++14 constexpr target, also using 8cc as the frontend ! [0] https://github.com/shinh/elvm
239.
by rkeene2 5y ago
URL for it: https://github.com/rkeene/saml-idp
240.
by rkeene2 5y ago
I implemented a SAML IdP from the spec and it wasn't too difficult to get through (I implemented everything including the XML parser, XML DS (Digital Signature), XML C14N (Canonicalization), RSA implementation). I did take some shortc

More ›