GaryGapinski

The use of "try and" is usually grammatically incorrect (when "try to" was meant).

I use a 43-inch 4K TV as a monitor located about 30 inches from my eyes. I've been using such for at least a decade, and would never return to a tiny porthole facing work of interest (such as a laptop, which is comically unsuited to serious, prolonged use).

I do use prescription glasses ground for that working distance and strongly recommend that (prescription lenses).

I recently (four weeks ago) had to replace the monitor/TV and spent more than a short while choosing comfortable typeface, font size, and RGB/BGR pixel ordering.

As some others have mentioned, if one's eyes are strained, corrections are warranted. I do not deliberately practice frequent distance gazing, but I suspect I do so unconsciously.

Lazarillo de Tormes:

https://en.wikipedia.org/wiki/Lazarillo_de_Tormes

Bulletproof TLS Newsletter — https://www.feistyduck.com/bulletproof-tls-newsletter/

I've been using inexpensive ~40-inch-diagonal 4K (3840×2160) televisions as monitors for quite a few years and will continue to do so. Current one is TCL 43S405 (wife commandeered the Sony 43X800E). A single monitor makes for far less configuration fuss — multiple monitors coerce distinct assignments and as well introduce discontinuities in the midst of the workspace (of which I was once tolerant, but no longer). I have yet to try anything in the 50-inch diagonal range, which would likely work but the periphery might go largely unused.

As of a short while ago (times are US/Eastern):

  C:\Users\gapinski>certutil -verifyCTL disallowed|more
  LastSyncTime = "9/23/2015 3:33 AM"
  [DisallowedCTL]
  ListIdentifier = "DisallowedCert_AutoUpdate_1"
  SequenceNumber = 01d0f584a9ad12f7
  ThisUpdate = "9/22/2015 6:18 PM"
  NextUpdate = EMPTY
  SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash"
  SignerExpiration = "8/14/2016 1:13 PM", "326.4 Days"
  CTLEntries = 57
…

Dunno, but http://scap-on-apple.macosforge.org/ might be of interest.

Pull up https://play.google.com/store in a browser and look at the TLS certificate chain.

Equifax Secure CA is the root CA for the certificate chain.

The intermediate CA (Google Internet Authority) issues the certificate for the end entity. Its CRL distribution point is http://crl.geotrust.com/crls/secureca.crl. There is no OCSP resource.

The end-entity certificate is wild-carded for a number of Google sites. Its CRL distribution point is http://www.gstatic.com/GoogleInternetAuthority/GoogleInterne.... There is no OCSP resource.

The relying party would validate the end-entity and intermediate CA certificates using CRLs (as no OCSP is available). These requests would be the only "data" sent as part of the certificate validation.

As the root CA is explicitly trusted (since it is present in the trust anchor compilation), it (Equifax Secure CA) is not contacted.

Explicitly removing trust for arbitrary root CAs (which can be prudent) will of course remove trust for end-entity certificates traceable to those CAs. Thus, if one removes trust for Equifax Secure Certificate Authority, one will no longer trust certificates issued by Google Internet Authority, such as the one used by https://play.google.com/store.

Trust via contemporary CA compilations and relying party PKI implementations is quite coarse. One essentially trusts all all CAs and subordinate certificates for a variety of purposes. Implementations vary in precision (or even presence) of revocation and constraint checking.

Bad week for an announcement, eh?

Start with (as root)

    apt-get install openssh-server
    apt-get install fail2ban
    ufw allow OpenSSH
    ufw enable

I use the following suffix to the /etc/ssh/sshd_config file:

    …
    72	#
    73	# local tweaks
    74	#
    75	Protocol 2
    76	PermitRootLogin no
    77	Banner /etc/ssh/banner
    78	UseDNS yes
    79	MaxStartups 1
    80	LoginGraceTime 15
    81	PubkeyAuthentication yes
    82	PasswordAuthentication no
    83	ChallengeResponseAuthentication no
    84	X11Forwarding yes
    85	AllowTcpForwarding yes
    86	DebianBanner no

    87	Match Address 192.168.0.0/24,127.0.0.1,192.168.1.0/24
    88	PasswordAuthentication yes

Line 82 should be commented out until you have generated an SSH key pair and placed the public key in ~/.ssh/authorized_keys, as it prevents logins using just a password. Lines 87-88 remove this restriction for local nets. Line 77 references a banner that you can provide which is presented upon SSH connection.

fail2ban with its default configuration will essentially just block objectionable SSH traffic. If you decide to extend it, create a /etc/fail2ban/jail.local file to supplement the default /etc/fail2ban/jail.conf file (the former augments the latter).

As others have mentioned, there are a number of resources available. Do not make all suggestions blindly: some are of questionable efficacy and complexity.

ufw will allow precise tuning of iptables. Watch /var/log/ufw.log for entries indicating traffic being dropped, either appropriately or not. Once more services are added (and secured), introduce related rules into ufw one by one. If your system is exposed to the general Internet, be particularly careful with such services' configurations.

The above minimal ufw commands will prevent many commonly used network services on the local network, such as CIFS. Some packages install custom ufw application definitions which can be listed with the ufw app list command (e.g., Postfix, Apache). Such applications usually open the services to all, as opposed to the just the local network.

A totally crap HN headline: the referenced article refers transitively to "The Catholic Church in America". More than a small difference. Even the Economist headline fails to identify the subject America — north, south, or both.

At least the The Economist has an article; Patheos has a less then a gloss. Check out the article in The Economist. Ignore the other feeble one.

Too bad I can't figure out how to diss this HN post. Reference the article directly, or at least offer a reference to a decent commentary thereon.

There's more than one "Catholic Church", kumarksi. Please try to discriminate somewhere below the planetary level in such matters.

You just wasted my time.

Vinyl is inferior to good (not lossy) digital.

Using vinyl as a medium is daft.

I do miss album covers. I don't miss the noise, defects, expense, and fragility.

Good speakers are worth the money. Vinyl is not in any way worth any money nor is worth obsessing about (unless obsession is the goal).

I do have an un-played Mosaic MQ10-177 available for anyone daft enough to be interested in vinyl. I thought it a worthy specimen of obsolete technology.

Add https://fedorahosted.org/scap-security-guide/, which I will at some point attempt to warp into an Ubuntu checklist, since I have always thought concordance on at least some security posture settings should be distro-neutral, with distro-specific implementations.

I haven't seen this problem on recent versions of Ubuntu (10.04, 12.04). fail2ban bans will preempt regular ufw rules (as they should).

Very nice. I'll be recommending this.

No. The one in front of me still has a lot of life in it, as do the four monitors. I have yet to do any serious work on mobile devices, including laptops (except when tethered to large monitors and a keyboard).

I expect the desktop will remain, if only as a convenient horizontal surface on which to place a keyboard and one or more displays. It won't matter where the computation takes place.

I use a commercial hosting service which includes email. It provides as options SpamAssassin and Spamdyke, which work as well as can be expected. Spamdyke's graylisting does a nice job of keeping out much spam, more effectively than anything else.

The hosting provider provides a web interface in addition to IMAP, but I use IMAP clients, primarily Thunderbird, rather than web interfaces to email.

What the provider does not have, and I'd very much like to have, is IMAP augmented by Sieve.

Glad to hear it. Discovery is always a lot of fun, regardless of latency.

Don't stop there. There were/are many good musicians performing excellent work from the 1950s and 60s on. Please keep looking.

I'll mention just a few I consider deserving of attention (and this is by no means comprehensive): Yusef Lateef, John Coltrane, Eddie Palmieri, Sun Ra, Oliver Nelson, John Hicks, Joe Henderson, Duke Pearson, Cal Tjader, Cannonball Adderley, …, MJQ, …).

If you would like to hear an(other) excellent tune in 5/4 besides /Take Five/ circa nine years later, check out Yusef Lateef's rendition of /Get Over, Get Off and Get On/ on the album "The Blue Yusef Lateef".

There are wonderful contemporary musicians, long-standing and novel, worth seeing at the most intimate of venues, the nightclub, as you have found.

My first nightclub experience, long ago, was Cannonball Adderley at the London House in Chicago, circa 1968, and I've enjoyed such a venue ever since. Nothing is better.

It was worse. I started in the late 1960s. Information was not easy to obtain as it is now. The computers were not particularly limited (or so it seemed at the time), but there really wasn't any decent internet until the late 1980s. Things were quite slow in comparison to the way they are now, particularly at the human-machine interface. Frightening amounts of paper were used for punched cards and printouts. While the old days were fun, I don't at all miss any of it.

Now, I can cheaply obtain any computing capability I might want for pennies an hour. I can obtain just about any information I need with a few keystrokes. I can easily benefit from the massive, readily accessible work of others.

I can no longer function effectively without using contemporary amenities, nor would I so want.