metafunctor

I'm switching to Debian for my companies and personal projects.

For 15 years or so, I used and recommended Ubuntu. But this is unacceptable and I won't be looking back.

Not impossible at all with a policy-filtering HTTPS proxy. See https://laurikari.github.io/exfilguard/

In this model, hosts don’t need any direct internet connectivity or access to public DNS. All outbound traffic is forced through the proxy, giving you full control over where each host is allowed to connect.

It’s not painless: you must maintain a whitelist of allowed URLs and HTTP methods, distribute a trusted CA certificate, and ensure all software is configured to use the proxy.

The key itself appears to have no validity period, the validity period is only for the certificate made for the key. Maybe you could create a CSR for the key/identity and then sign it with your own CA (or self-sign with openssl) for whatever validity period you like. Then `sc_auth import-ctk-certificate`.

Good point! The web is going through its own endless September.

And so, it seems, is everything else. Perhaps, this commentary adds no value — just old man yells at cloud stuff.

The npm team is, frankly, a bunch of idiots for saying that. It has been obvious for TEN YEARS that the bar for publishing npm packages is far too low. That’s what made npm what it is, but it’s no longer needed. They should put on their big boy pants.

Welcome to the web side. Everything’s bonkers. Hard-earned software engineering truths get tossed out, because hey, wtf, I’ll just do some stuff and yippee. Feels like everyone’s stuck at year three of software engineering, and every three years the people get swapped out.

I never saw it as a problem for nginx to just serve web content and let certbot handle cert renewals. Whatever happened to doing one thing well and making it composable? Fat tools that try to do everything inevitably suck at some important part.

It’s quite easy to run your own DNS server — I've found it a worthwhile exercise. Of course, you’ll need a server to run it on.

Those muscle mass percentages cannot be right. How were they measured?

Sabre or Sable?

I was excited to try this, since I'm a bit tired of selecting the input manually multiple times per day. Unfortunately, connecting AirPods automatically switches the input to them, regardless of the previously selected input device, whether it's an aggregate device or not.

OK, so the defusedxml.lxml submodule is deprecated and one should use the other APIs from defusedxml instead. That does not mean that defusedxml in it's entirety would be useless.

Do you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?

Type safe and unguessable IDs are what I've been using in my projects for the past, oh, 10 years maybe? Inspired by Stripe!

In my databases, I often prefer integer primary keys for performance reasons. On the other hand, I don't want to expose my primary keys because they are easy to guess.

Recently I've been playing with Rust, and ended up publishing a library to encrypt IDs in they way I like:

https://crates.io/crates/cryptid-rs

If they can get your sqlite files, what makes you think they wouldn't be able to get the encryption key as well?

A commonly used icon or symbol for language selection seems to be the globe symbol (U+1F310). HN seems to filter it away, though, so cannot use it in this comment.

So Orange won 12 years time to pay whatever you won in the end?

That's a factor of about 2.2x, assuming 7% capital gains year-on-year.

If the sums are large, it would've made a lot of sense for Orange to delay the decision for 12 years until having to pay.

But I'm not sure at all of the sums here were that substantial.

Agreed, I think this is something the English language community should solve.

IMHO, I think “free” should be reserved for the wider meaning encompassing all the various aspects of freedom.

And a (new?) word like “gratis” should be used for the you-dont-have-to-pay-money-for-this-now meaning.

That would make it quite easy to maliciously lock someone out.

Instead locking accounts, appropriate throttling might be a better idea.

Yeah, there's no amount of dedication that will make the business fly if you stubbornly want to do “your thing”. You have to do what the market can find and is willing to pay for. Many of such businesses can be discovered without starting full-time.

Bugs happen also in access control. Unguessable IDs make it much harder to exploit some of those bugs. Of course the focus should be on ensuring correct access control in the first place, but unguessable IDs can make the difference between a horrible disaster and a close call.

It's also possible to use auto-incrementing database IDs and encrypt them, if using UUIDs doesn't work for you. With appropriate software layers in place, encrypted IDs work more or less automatically.

I've ended up implementing a layer on top of "magic" which, if magic detects application/zip, reads the zip file manifest and checks for telltale file names to reliably detect Office files.

The "magic" library does not seem to be equipped with the capabilities needed to be robust against the zip manifest being ordered in a different way than expected.

But this deep learning approach... I don't know. It might be hard to shoehorn in to many applications where the traditional methods have negligible memory and compute costs and the accuracy is basically 100% for cases that matter (detecting particular file types of interest). But when looking at a large random collection of unknown blobs, yeah, I can see how this could be great.

Mistakes can happen. But if code comments are frequently not updated as the code evolves, it is a level of lazy that will probably manifest in other ways as well.

Do you think you know better than the companies developing these products and the consumers buying them? Do you believe you understand what the right products and fair prices should be? This seems to justify your use of terms like 'highway robbery' and calling people 'stupid'.

I would have words for such viewpoints, but for the sake of a civilized conversation, I won't express them here.

It's a crowded market, but it IS a market. In fact, crowded markets are the ones that work the best.

If people find their app, like what they see, and are willing to pay the price, what is your objection exactly?

Many houses here have those as well. The outlets in question are rated for 3 x 230V x 16A, about 11kW.

I'm guessing it would be the same in Slovenia.

For a typical house in my parts (Finland), it would be 230V and 3 x 25A fuses, so maximum power draw is 17kW.

Most houses would be able to upgrade to 35A without extensive reworking of cables, getting to a 24kW maximum.

Also 50A and 63A are available for consumers in most locations, but would require re-evaluating the cabling coming to the house.

There are many ways, but a popular option is to add a “PDF Advanced Electronic Signature” (PAdES) compliant approval signature on the PDF file. You can tack on as many of these on a PDF as you wish, and they have a visual component you can control and place where you want. Most PDF readers support these and can verify the signatures using a PKI system similar as is used with HTTPS. Adobe Reader is a popular choice. Notably Apple's Preview.app does not support verifying PDF signatures.

In the EU, often a personal key on a tamperproof personal device is used. In many EU countries these are readily available to citizens and the resulting signatures carry the signer's name, a unique personal ID code, and have the same legal effect as a handwritten signature. This is called a "qualified electronic signature". Qualified trust service providers verify the identities of people and provision the hardware to them.

The EU system is great in that when creating or verifying signatures, you don't necessarily need a service provider at all — the software is free. Of course a good system can help managing signature invitations, the documents, archival, reminders, etc. But it's not needed for security; in fact the most secure way would be to not give your documents to a third party at all.

Alternatively, the e-signing providers private key can be used to create a seal on behalf of the person signing. It's then up to the security of the e-signing provider, how they validate the signer's identity, etc, to decide how trustworthy such a signature is.

Like when exiting a roundabout? I have at least one almost everywhere I go…

This is, in my experience, incorrect.

Driving a recent Model S.

Selecting the temperature can be done on the wheel, or with a single press on the screen in a predictable spot.

Same with media: play, stop, volume, next, previous.

Other adjustments, yes, those may need a modal interaction. Much like physical dials. I would slightly prefer physical dials, but not something I would need to adjust during drives almost ever, so I don’t see a problem here.