madjam002

The OPs workflow is entirely possible with https://github.com/mssun/passforios since over a year ago.

Yes you can, you can use the https://github.com/mssun/passforios app which as of over a year ago supports Yubikeys.

The UX of having to grab your Yubikey every time is a bit clunky though (although that is limitation of the security key medium itself rather than the app).

So give up all my baseline hardened VM configurations and go back to patchy Ansible scripts that leave the OS in a different state every time? No thanks

Yeah I normally use oci-containers but for this workload the only supported method of installation is a `docker-compose.yaml` file.

I've just written a systemd service that does `docker compose pull` and `docker compose up -d --remove-orphans` with the compose file being written to the Nix store, works well.

I've used Nix for 5 years now and use it heavily in production, and in my opinion, just do what works for you. If you try and use Nix 100% "correctly" then you'll end up like the countless other people who tried Nix and failed.

Especially for toying around in dev environments, be pragmatic and take advantage of its amazing strengths, but if distrobox lets you enjoy using NixOS and speed up your workflow, so be it.

Heck I'm spinning up some services in production just now and I'm reaching for Docker Compose as that's how the vendor officially supports deploying their software. Turns out NixOS can still bring some benefits to a Docker Compose workflow, deploying it via a systemd service, config managed in Nix, it's not as nice as building the service entirely in a Nix derivation and deploying it natively, but it's still better than without NixOS.

Yeah this is annoying purely from a disk space perspective too as I easily go through 200GB of disk space in a day if I'm actively working and iterating on some Nix code

I think the Nix language is a big barrier to entry for NixOS, I’ve used it quite a bit and still struggle to debug problems, I think lack of types or some basic type inference doesn’t help.

That said I’ve had a very positive experience packaging NodeJS apps with Nix, the /nix/store lends itself very nicely to the mess that is node_modules as each NPM package can be stored once in the store and NodeJS can read the dependencies directly from /nix/store if using something like Yarn PNP, I wrote a Yarn plugin to make this a bit easier https://github.com/madjam002/yarnpnp2nix Using Nix as a development shell along with direnv makes for a very nice developer experience.

The thing is though, you can get these benefits even without using NixOS, you can install Nix on various Linux distros and personally I use it on macOS.

NixOS is great for servers where reproducibility and consistency is important, personally I was never a fan of tools like Ansible that are a bit of a hack.

That setting doesn’t affect what I’m saying. I want to disable Google Prompt as it’s insecure for my threat model. All “skip password when possible” does is give you the option to use a passkey to login without a password, it doesn’t prevent an attacker from using a password + Google Prompt to login, bypassing the need for any of the configured 2FA security keys or passkeys.

Yeah for sure, which is why I’m not fussed about not being able to use Advanced Protection because I don’t fit in with their target audience.

But I do wish that people on standard accounts could just disable their forced “Google Prompt” authentication method and just use their own 2FA security keys with fallback to backup codes.

But if you enable Advanced Protection then recovery/backup codes are disabled right? (Maybe I’m wrong)

So the only option to have recovery codes available is to not used advanced protection and then have this “Google Prompt” forced on you, which I’d like to disable as it is another physical attack vector which is undesirable especially when travelling.

Advanced Protection is nice but practically a non starter or very difficult in a lot of situations, e.g if you're travelling and all of your security keys get stolen and your backup security key is half way across the globe, you'll wish you had 2FA backup codes then.

Yet they still don't have a way to disable the 2FA prompt offered in the Gmail app (called "Google prompt").

It's a shame that you can add hardware security keys to your Google account and all of that can be bypassed just by pressing "approve" in the Gmail app when you're trying to login.

The attack vector that I'm thinking of here is your phone being stolen while in public while unlocked, it doesn't even prompt for further biometrics when approving a login from the app.

Still flawed seeing as you can't disable Google Prompts (that I know of) which means any security key 2FA or Passkeys that you've set up can be bypassed if your phone is stolen as someone can simply click a prompt in the Gmail app.

I wish they gave the option to disable this.

I was running the lightshow for a medium sized nightclub and ended up building a custom React renderer that would declaratively control all of the lighting fixtures on the dance floor, strobes and smoke machines included. The entire show was controlled with various MIDI controllers (similar to Launchpads) which also had their button grid programmed using React.

It was suddenly very intuitive to build user interfaces on a button grid MIDI controller using standard React design patterns, not to mention the actual light shows being implemented as React components.

I’ve been using quickwit.io for some local data processing job logs and it seems to be very easy to run, not very IO intensive and running fine on a single node with modest hardware with >2 billion log rows. It has a really cool dynamic schema feature too.

I found it easier to setup and configure than Loki.

The UI is very basic for now but I’m excited to see what the future holds for this project!

Tailscale issue

https://github.com/tailscale/tailscale/issues/1543

There is an open GitHub issue for this and it’s already been implemented in the Tailscale client, it’s really nice too as the DNS records are pushed out to the local DNS resolver on each Tailscale client, rather than being lookups to a separate server, so it’s super fast.

Unfortunately there aren’t any options for it on the Tailscale control panel, but if you use Headscale you can configure it and take advantage of it now.

It would be awesome if this could use Quickwit as a backend which is a new promising alternative to Elasticsearch, I’ve been using it internally and it’s much more lightweight and easier to run.

Same but for different reasons, mine was an expensive TV with a single core processor and running Android TV, and it was incredibly slow. I remember connecting via adb and watching the volume indicator applet use 100% CPU when trying to change the volume from the remote control and only showing up 10 seconds after pressing the button.

Isn’t this how they do wifi in tunnels and metros? Using coax and “leaky feeders”?

I’d love to read more about deployments like this in the wild and how they work.

So it’s okay to take away the creators income and replace it with your own just because your project “makes the internet a better place” whatever that subjective tagline means?

The criticism is well deserved imo. It’s a sleazy move from Brave.

That doesn’t provide any geolocation information (unless it’s changed recently?), for that you need OS AddressBase

There are and they cost upwards of £20,000 a year for a license. There’s a reason why smaller delivery companies get the address wrong and that is probably part of the issue.

Any live content online, whether it’s Youtube Live or Twitch or anything else, requires a TV license, so long as it’s a “television programme service”. This is vaguely clarified to depend on: - Whether a service has a regular schedule of programmes - How continuous a service is Editorial control and consistency - The quality of production and editorial values.

(source https://www.cordbusters.co.uk/do-i-need-a-tv-licence-twitch-...)

So I imagine most Youtube/Twitch indie content wouldn’t count, but any foreign TV broadcast would. It’s ridiculous.

I just bought a second hand Mac which is due to arrive and am worried about this.

If I set up the device with my Apple ID and enable Find My, is there any way for the original owner to lock me out afterwards even after I’ve associated the device with my own Apple ID?

I saw Maxi Jazz perform Insomnia and God is a DJ live with the Heritage Orchestra and Pete Tong, what a fantastic night. RIP

Out of interest how do you run most of Observable locally?

Probably TLS SNI inspection

Yikes, who remembers these https://codepen.io/maheshambure21/pen/ZGevNP :)

The issue isn't so much the speed as yes I use bulk SQL statements and can upsert like 4-5k rows per second, it's more the disk writes which I find unsettling as after a few months I've noticed several 10s of TBs of disk writes from Postgres onto the SSDs which seems like unnecessary wear.