TimWolla

You can use `psub` for process substitution, e.g. to compare two sorted files:

    diff -u (sort a |psub) (sort b |psub)

I was not telling anyone that they must be able to see this properly. I was saying that I was able to see this properly and I was saying that according to an established standard it should be as readable as it gets.

Sure, the standard might be lacking, but then the standard should be fixed. As a website author you need something to refer to when you don't experience these issues yourself.

> Don't just quote some automated tool at people who very clearly experience something else.

I don't think that's a fair response to my comment when it was GP who specifically brought contrast into the discussion and even linked to a contrast checker that also checks two colors against the WCAG guidelines.

I wasn't I claiming that everyone is able to read it. I was just saying that according to the standard they themselves referenced it was fine. The fact that it actually was not fine for certain dark mode configurations is orthogonal to that and was not taken into account by both of us.

The contrast is fine, see: https://news.ycombinator.com/item?id=26160608

I found it perfectly readable and checked with Firefox' accessibility tools: The contrast of the main text is a 12.19 and thus meets the WCAG AAA standards for accessible text. [1] is the documentation Firefox links to.

[1] https://developer.mozilla.org/en-US/docs/Web/Accessibility/U...

I'm being redirected to EFF if my 'Referer' includes news.ycombinator.com. Anyone else seeing this?

    $ curl -I 'https://www.dzombak.com/blog/2021/02/Securing-my-personal-SSH-infrastructure-with-Yubikeys.html' -H 'Referer: https://example.com'
    HTTP/1.1 200 OK
    *snip*

    $ curl -I 'https://www.dzombak.com/blog/2021/02/Securing-my-personal-SSH-infrastructure-with-Yubikeys.html' -H 'Referer: https://news.ycombinator.com/'
    HTTP/1.1 302 Moved Temporarily
    *snip*
    Location: https://supporters.eff.org/donate/join-eff-today
    *snip*

It is possible to require confirmation before `ssh-add` allows to use a key. From `man ssh-add`:

     -c      Indicates that added identities should be subject to confirmation
             before being used for authentication.  Confirmation is performed
             by ssh-askpass(1).  Successful confirmation is signaled by a zero
             exit status from ssh-askpass(1), rather than text entered into
             the requester.

I created an HAProxy configuration that should be equivalent to the nginx configuration within the Signal-TLS-Proxy repository:

https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7...

I could not test it with the Signal client yet, because the Beta is not yet available for me. However I verified that the nested TLS works using openssl and netcat.

Hetzner is (one of) the largest German dedicated server providers.

They are DIN ISO/IEC 27001 certified: https://www.hetzner.com/unternehmen/zertifizierung. Of course if you only store encrypted data you don't really need this auditing.

You can buy Threema within their store if you can't or don't want to use Google Play Services: https://shop.threema.ch/

You might be able to regain access if you still have your SSH key: https://news.ycombinator.com/item?id=25648815

They do: https://docs.github.com/en/free-pro-team@latest/github/authe...

I remember something about the database being a flat file / flat files. Is that (still) true? How are the two machines being synchronized?

See additional context in this issue in docker-library/memcached: https://github.com/docker-library/memcached/issues/63#issuec...

And this issue in my docker-adminer: https://github.com/TimWolla/docker-adminer/issues/89

You can buy Threema from within their own shop: https://shop.threema.ch/. They support Bitcoin.

> an actual run of the mill SOCKS proxy would have visibility of the user's queries and their identity, defeating the purpose of the design.

Why would it have visibility of the queries? If I send a TLS connection (containing my DoH query) through that SOCKS proxy, then the SOCKS proxy is unable to decrypt that TLS connection without breaking certificate verification and thus can't read my DoH query.

Yes, I understand that. But I don't understand what ODoH does better than a run of the mill SOCKS proxy, such as Tor.

So, having read the blog post from Cloudflare I don't understand why the proxy (needs to terminate|terminates) TLS.

I thought HTTPS proxying (or rather: Any TCP protocol) was a solved problem by the HTTP CONNECT verb or SOCKS proxies.

What am I missing?

Probably better source, the blog post at Cloudflare: https://blog.cloudflare.com/oblivious-dns/

See also: https://news.ycombinator.com/item?id=25344220

> So I cannot access the box anymore at all?

My understanding is that you can access it directly. But you can't embed e.g. images or JavaScript from that server within a website running on a public IP address. I consider that a good thing.

You need to store some kind of state if you want to protect the form from CSRF attacks. You usually want to protect the form.

> The original author moved to gitlab and started GPG signing commits with his real GPG key.

Signed commits from them go back at least 1 year. So its not "started", but rather "continued" signing.

PHP follows a consistent philosophy as well. The PHP functions are usually named after the C functions they wrap. And in fact: The MySQL C client library contains a function called mysql_real_escape_string.

see: https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-escape-str...

> I'm curious if that copied the text or the placeholders.

It copied the text.

A hidden service uses 6 middle nodes, 3 for the server, 3 for the client.

Monthly typically (and when important security updates are released): https://github.com/docker-library/official-images/pulls?q=is...

According to https://en.wikipedia.org/wiki/Modulo_operation#In_programmin...:

- JavaScript is consistent with Java, PHP.

- Older C may behave as either Python or JavaScript.

- Modern C behaves like JavaScript.

So basically Python is the outlier here.

Is it planned to move issue tracking to Salsa?

I enjoy filing bugs via email, because that does not require me to create an account and I need email notifications to become aware of updates anyway.

Yes, you are correct. The script ends no later than 2:30 and then there's a delay of up to 1 hour.

This works, but compared to using systemd it has the drawback that the range of possible times is anchored to the configured time in cron. The systemd timer example I gave causes the next cycle to start when the previous job finished.

So if it initially runs the script between 0:00 and 1:00 and the script takes 1.5 hours to finish then the next run will be between 1:30 and 2:30 the next day, instead of 0:00 and 1:00.