Hacker News Reader

curbenon Fearless SSH: Short-lived certificates bring Zero Trust to infrastructure

Cloudflare has been offering SSH CA-based authentication for more than 2 years [1], I wrote a guide back in feb '23 [2]. The announcement is more about offering new features, such as more granular user control.

[1]:https://web.archive.org/web/20210418143636/https://developer...

[2]: https://mdleom.com/blog/2023/02/13/ssh-certificate-cloudflar...

curbenon Show HN: I made a super-simple image CDN

Image CDN primarily offers image resizing, especially useful for responsive images. It has a sizable market, both Cloudflare and AWS offer image processing service, see also major players like Cloudinary and Cloudimage.

Image and general CDNs are not exclusive: pictures resized on-the-fly and hosted on image CDN, while html/js/css hosted on general CDN.

curbenon Autossh – automatically restart SSH sessions and tunnels

If "orthodox" means "vpn traffic cannot be established through third-party cloud infrastructure", then tailscale and any other cloud-hosted ZTNA solutions wouldn't be accepted in that kind of enterprise.

curbenon Autossh – automatically restart SSH sessions and tunnels

SSH protocol does not protect against weak configuration, e.g. password authentication without brute force mitigation. Zero-trust can be misconfigured too, so it depends how well either of them is configured.

curbenon Adapter lets you use cheap eSIM plans on any Android phone

The manual mentions it includes EasyEUICC hash in an ARA-M slot, so it should work. ARA-M does not apply to OpenEUICC; as a system app, it can work with any esim.

https://www.sysmocom.de/manuals/sysmoeuicc-manual.pdf (p. 26)

curbenon Adapter lets you use cheap eSIM plans on any Android phone

JMP SIM Manager is a rebadged version of EasyEUICC available on f-droid. JMP resells eSIM card and usb reader from https://www.estk.me/product/

curbenon TOTP Codes in the Terminal

for anyone new keepassxc, do check out the auto-type feature. you can trigger it (through keyboard shortcut) to type TOTP digits.

curbenon How to Yubikey

On Android, to unlock Keepass database secured with Yubikey, an alternative to Keepass2Android+ykdroid is KeePassDX[1] + Key Driver [2]. Both USB and NFC are supported.

[1]: https://f-droid.org/en/packages/com.kunzisoft.keepass.libre/

[2]: https://gitlab.com/kunzisoft/android-hardware-key-driver

curbenon Pup: Parsing HTML at the command line

I'm using xmlstarlet in Alpine as a bare minimum way to scrap a webpage in CI pipeline.

curbenon Show HN: Browser extension that spoofs your location data to match your VPN

I'm using these FF addons CanvasBlocker and Spoof Timezone to spoof UA and timezone. I checked vytal.io and it shows those addons can't fully spoof web worker method. I usually use https://browserleaks.com/javascript to test spoofing addons.

curbenon Zorin OS 16

I think the most useful feature of modern filesystems (e.g. ZFS & Btrfs) relevant to desktop usage is the ability to create snapshot. Software store can automatically take a snapshot before add/remove/upgrade apps; if an upgrade causes issue (e.g. blank screen so there is no way to downgrade), just reboot and choose previous snapshot from boot entry.

https://arstechnica.com/gadgets/2020/03/ubuntu-20-04s-zsys-a...

curbenon Tz: A Time Zone Helper

The diagonal combines light and dark themes' screenshot.

Light: https://postimg.cc/BPW3vwJN

Dark: https://postimg.cc/dkZvwKcL

curbenon Piscina – The Node.js Worker Pool

AFAIK this is a wrapper of worker_threads API. https://github.com/tuananh/camaro utilises this for multi-threading processing of XML input. Hexo (static site generator) is attempting to utilise this library (https://github.com/hexojs/hexo/issues/4355).

curbenon Replacing Dropbox in favor of DigitalOcean spaces

Hetzner managed nextcloud costs $12/month (https://www.hetzner.com/storage/storage-share?country=us).

curbenon The State of IPv6 support on the Tor network

I have a .onion running on ipv6-only host and it's been working fine for the past few months. Relevant torrc configs:

  HiddenServicePort 80 [::1]:8080
  ClientUseIPv4 0
  ClientUseIPv6 1
  ClientPreferIPv6ORPort 1

curbenon Show HN: Thumbnail.ai – Just paste a blog post link and get a thumbnail

I'm using Statically (https://statically.io/) which offers screenshot API so thumbnail can be generated automatically. In my blog template, I use the following snippet:

  <meta property="og:image" content="https://cdn.statically.io/screenshot/<%- post.link %>">

curbenon Maps.me is gone, and we must bring it back

There is an existing f-droid version of Maps.me [1] and this looks like a separate effort. Despite having access to the source code, map hosting is a non-trivial problem [2].

[1]: https://gitlab.com/axet/omim

[2]: https://gitlab.com/axet/omim/-/issues/176

curbenon Show HN: Meli, a Netlify-like platform for deploying static sites

This project's logo reminds me of Metricon [1], an Australian construction company.

https://metricon.azureedge.net/Metricon/media/metricon/about...

curbenon 1MB Club

[1] generates ico, png and svg. you may want to remove some favicons from the generated HTML snippet; in my brief testing, Firefox loads both png and svg, while Chrome loads ico.

[1]: https://realfavicongenerator.net/

curbenon DKIM: Show Your Privates

> ...email providers to try deploying a key management strategy similar to the one I’ve described in this post.

Assuming author meant key rotation, Protonmail[1] offers automatic key rotation by using CNAME that alias to DKIM TXT which is rotated once in a while.

[1]: https://protonmail.com/support/knowledge-base/anti-spoofing/

curbenon Show HN: Build a DIY license plate reader with machine learning

This reminds me of an article [1] I read a few years back which utilised OpenALPR.

[1]: https://www.freecodecamp.org/news/how-i-replicated-an-86-mil...

curbenon Show HN: UIDesignDaily – soft launch with 600 open-source designs

If credit is not required, looks like a public domain thing. CC0 [1] is one, there are also some other public domain licenses [2].

[1]: https://creativecommons.org/publicdomain/zero/1.0/

[2]: https://choosealicense.com/appendix/

curbenon A new hash algorithm for Git

The decision was made before the release of Blake3. The article did mention the algorithm is no longer hardcoded (hence the ability to support both SHA1 & SHA256). This means it's possible to transition to Blake3 (or any other) in future, though it won't be trivial.

curbenon Every Google result now looks like an ad

Startpage shows more relevant local results for me, it's essentially a proxy to Google search. DDG supports redirect to Startpage by using "!s".

curbenon DuckDuckGo Lite

I get the error when I search using right-click menu or through an embedded search box. Regular search works fine.

The ones not working have Origin request header.

curbenon DuckDuckGo Lite

html minifer mostly just remove the whitespaces. Compression (gzip or brotli) preserves the source, i.e. decompressed file is exactly the same as the original's; whereas minifier alters the source.

curbenon The Ever-Present Glow of LED Greenhouses

> claims about LED lifetime costs based on (seemingly false) figures about durability. (E.g. drive around Los Angeles and see the dead/dying LED streetlights all over the place).

LED can be made durable if desired. In Detroit's case[1], the high failure rate can be attributed to manufacturer cutting corner on heat dissipation.

[1]: https://news.ycombinator.com/item?id=19848794

curbenon A uBlock Origin update was rejected from the Chrome Web Store

It has been a core feature since v50, albeit with less feature than the addon. It's still disabled by default, just need to toggle the following configs to enable it:

  privacy.userContext.enabled;true
  privacy.userContext.ui.enabled;true
  privacy.userContext.longPressBehavior;2

The last config is so that you can open a new container tab by long-pressing the new tab button.