blop

Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...

Any reason you chose conjur instead of openbao? (the guaranteed open source/no restriction fork of hashicorp vault)

Another recommendation for mise, in my case it has already fully replaced brew, stow and direnv since I started using it this January, and it has many more features I'm not using yet (secret management, tasks, automation, ...), all from a single rust binary. Also, unlike homebrew/linuxbrew, the install path for apps can be set to anywhere and is fully portable (it's all relative symlinks).

So far I never had any issue with it or any backward incompatibilities when upgrading, despite the very frequent releases and constant new features. The developer also seems very security minded (he immediately added a "minimum release age" feature for all apps when the trivy github action debacle was made public)

drama matters because most users don't want to have their favourite FS randomly removed from the kernel unexpectedly after some OS update :)

That said I certainly hope that one day the technical advantage of bcachefs will be so overwhelming that maybe the decision to remove it will be overturned. And if big vendors make it their default FS the bus factor will disappear (even if unofficially you'd still be the sole maintainer, but no one cares about that in the enterprise world...)

That's what I meant, it's always risky to rely on a single person for such an important subsystem as storage... I'm also very sad that bcachefs has been kicked out of the kernel, it is really a very promising FS.

So that leaves btrfs which always seemed complex and brittle to me (compared to zfs at least)

Anton is definitely wonderful! He explains everything very well with no drama and BS. High information density and yet very clear!

I think the reviews should also include the social aspect of these filesystems...

There is and have been many promising and exciting FS to replace the old boring ones, but for storage you not only want to avoid technical issues but also maintainer(s) drama...

yes indeed, zfs for my nas basically

For peace of mind I'm still using zfs (since the last 15+ years) but I'm definitely not impressed by the performance...

This is the elephant in the room regarding the big "digital sovereignty" talks in the EU. For the moment in the EU institutions the focus is mostly at the post-acceptance stage that everything must eventually migrate off US clouds. There is still some denial and hope that things will go back to "before" because it's going to be extremely costly to migrate, but at least high level EU civil servants start to see the strategic value of moving out.

However there is ZERO talk about mobile platforms... No alternative solution like linux for the desktop, no money or care given to the few alternative that tentatively exist, and zero talk about forcing companies (at least for the ones shipping android phones) to open up their firmwares and allow users to install alternative OS if they want to sell in the EU.

So whilst the backend guys more or less got the memo about sovereignty, I think there is still a lot of educational work to do regarding end user devices and what kind of digital slavery hole we're digging ourselves in...

I use syncthing to automatically sync my dotfiles git directory across PC/laptops, and stow to manually update symlinks when I add a new dotfile (the content of existing dotfiles is synced by syncthing already)

That way I don't have to remember to commit+push+pull changes to existing dotfiles (like bashrc or vimrc which I edit often) to sync them to other machines, it happens automatically in almost real time as soon as the file is saved on one of my machines (syncthing uses inotify to detect changes on monitored directories)

looks like LLMs aren't mature enough yet to play long-game xz-style attacks without detection... Scary stuff though :( These supply chain attacks are getting really wild

ah sorry, I thought you wanted a delivery notification when you are sending an email via your own SMTP server (i.e. when thunderbird is configured to use your own outbound SMTP gateway)

Well I don't know if you wrote this in a sarcastic way or not, but when you write a new message in Thunderbird just turn on `Options -> Delivery Status Notification` and your mail server will email you back with a delivery status message (success or failure, although failure can take some days if the receiving server doesn't outright reject your message)

As my main desktop computers I've been using Fedora and Windows (for gaming only) virtualised on top of a single proxmox host with 2 GPUs passed through for more than 10 years... Upgraded all the way to latest versions (guests and hosts) without ever having to reinstall from scratch. I upgraded the hardware a few times (just cloned the disks), and since the desktops are virtualised, Windows always worked fine without complaining about new hardware drivers (only thing to change was GPU driver)

Another benefit is block-level backups of the VMs (either with qcow2 disks files or ZFS block storage, which both support snapshots and easy incremental backups of changed block data only)

Proxmox is great for this, although maybe not on a laptop unless you're ready to do a lot of tweaks for sleep, etc.

I think people like using makefile as a simple task runner because it's pretty much ubiquitous and also a kind of auto-descriptive standard. Interactive shells usually do autocompletion on makefile targets so it's easy to see what you can run on a project (more so on old or foreign projects)

actually the telescope devops guys were hiring a couple years ago on HN: https://news.ycombinator.com/item?id=38101085 :-D

I found this pdf presentation with lots of great technical details about data management and a devops infra oriented view of this telescope: https://ci-compass.org/assets/602137/2025jan23_cicompass_rub...

Worth a read for the devops guys around here!

  - about 20TB per day, around 100PB expected for the whole survey
  - 0.5PB ceph cluster for local data
  - workloads on 20 nodes kubernetes cluster/argocd
  - physical infra managed with puppet/ansible
  - 100Gbs(+40Gs backup) fiber connection to US-based datacenter for further processing

yes, it's my biggest worry too.

At least with keepassDX on android there is no internet access permission needed by default, but if a compromised update suddenly required it I don't know if Android would prompt about it since all apps have internet access granted without prompting :(

I also wish it was possible to block automatic updates of specific apps on the play store... So at least we could be in control over updating critical apps such as these without having to micromanage updates for all apps.

Syncthing on at least one server with zfs or btrfs snapshots

Just use syncthing ...

Fair enough about the android mobile client... My use case only involves meshing linux appliances across various networks so we only need the nebula core binaries which are under MIT license

https://github.com/slackhq/nebula/blob/master/LICENSE

Nebula is great! From what I found after testing other solutions (headscale, netbird, netmaker) It's also the only completely open source mesh vpn that can be configured with a highly available control plane (just run multiple lighthouses, nothing is shared) and also supports multiple root CAs for nodes, relays and control planes (and each node can be a relay too)

I just wish there was a kubernetes operator to easily set up mesh sidecars like with tailscale and it would be perfect!

There's actually an annual conference dedicated to Spreadsheet risks, they have lots of Excel horror stories on their website: https://eusprig.org/research-info/horror-stories/

I miss perl.

I don't think there are any other scripting languages that allow you to write very concise one-liners that can do very complex things. That's also where perl got its bad reputation from, but it's more a discipline issue than a language problem. I always rewrote my explorative one-liners more cleanly when I committed them to a final program, but nothing forces you to do it like python does.

It was all magic to me until one day I finally took the time to look at git internals.

You can build a valid git repo with simple unix shell commands, and that really helped me to understand the magic behind the git commands:

https://git-scm.com/book/en/v2/Git-Internals-Git-Objects

I'm still self hosting after more than 15 years and I think what matters most is the reputation of your IP address, so it can be hit and miss depending on where you host your mail server...

with gmail you can do:

    foo+anything  => redirected to foo
    foo.something => redirected to foosomething (so . is not the same as +)

The + isn't always accepted in dumb email checks though, and spammers know about it...

I still run my own email system (postfix/dovecot for imap), mostly for one reason: the virtual username function of postfix:

I configured postfix with:

    recipient_delimiter = .

which gives me unlimited dynamic virtual addresses (username.<something>@mydomain), so I know where spam/leaks come from if I get unsolicited mail directed to `username.<unique_name_per_registration>`, and it makes it trivial to block.

I know that you can do the same thing with google addresses using + as a delimited, but the + sign is often not allowed in dumb email checks. Also spammers probably know about + and strip it automatically anyway...

Wow! Thanks for that comment, I have a Dell U3818DW with a KVM switch and I didn't know you could control it with DDC commands!

So for linux (e.g. fedora):

  dnf install ddcutil
  ddcutil capabilities -d 1 # show the available commands
  ddcutil setvcp 60 0x11    # for example switch to HDMI 1
  # assign a global shortcut key to the `ddcutil setvcp` command you need

And for windows:

  - download the "Dell Display Manager" software from their support site
  - assign a shortcut key in the Dell Display Manager: "Input Manager" tab => "Favourite Input Shortcut Key"

I used the same shortcut (Ctrl-Alt-ScrollLock) for both linux(kde)/windows