thewisenerd

dupe (2h ago): https://news.ycombinator.com/item?id=50364814

tailscale got hacked recently? sources?

they had a priviledge escalation vulnerability that requires the attacker to already be a part of the tailnet, and more specifically allows a user-to-root escalation devices the attacker can tailscale ssh to.

> Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is. [1]

eMudhra/TLS certificates have nothing to do with this (?).

[1] https://news.ycombinator.com/item?id=50266179

path traversal and IDOR..

likely been active since the inception of these capabilities

wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)

while they do this, i hope they do not drop support for regular/other terminals

ignoring ALL the AI/agent features, herdr has been a decent replacement for tmux with saner defaults

so much so that i'm reaching for installing herdr instead of tmux and i would like to not be locked to a "desktop app" for it

from previous [1] threads on the iPad Mini, at least aircraft pilots are a target audience

[1] https://news.ycombinator.com/item?id=19421163

we get these hundreds of thousands of lines cost exports on a daily basis from our cloud provider

we process it 'daily' convert it from csv to parquet with a little post-processing for attribution, and have a small duckdb-powered dashboard/wrapper for reporting and dynamic queries

what's the difference between this and BratishkaErik's version [1] which i believe is used by fedora[2] today?

[1] https://github.com/BratishkaErik/ncdu

[2] https://packages.fedoraproject.org/pkgs/ncdu/ncdu/

[year].[month].[patch]

ubuntu does two releases in a year, one in april (26.04) and one in october (26.10 on october 15)

https://en.wikipedia.org/wiki/Ubuntu_version_history

they do have a new shiki based syntax highlighter in code blocks `rich_text_preformatted.language`

https://docs.slack.dev/reference/block-kit/block-elements/ri...

admittedly i don't think there's a way for humans to do it through the ui currently yet, e.g.,

@@@ ```lang foo ``` @@@

are we referring to jenkins here perhaps?

> I'd have vetoed Berkeley Mono right away

this is bait. berkeley mono out of the box sure doesn't do O0 separation but their "compiler"[0] lets you get a dashed one _very_ easily.

[0] https://usgraphics.com/products/berkeley-mono#:~:text=Custom...

podman's been great for me on macOS for testing stuff quick; which earlier used to need a whole limactl[3]/virt thing.

you can set it up with qemu-user-static for --platform linux/amd64; i don't remember which i exactly used, or if official docs have been updated for it but looked something like [1]

there is one sneaky bug in qemu that breaks uv [2] for cross-platform targets so i keep having to fall back to lima for that, but great otherwise.

[1]: https://www.itix.fr/blog/qemu-user-static-with-podman/ [2]: https://github.com/astral-sh/uv/issues/16024 , https://gitlab.com/qemu-project/qemu/-/work_items/3130 [3]: https://lima-vm.io/

puppy linux on a live USB here :)

from the author's mastodon post [0]

    I just published Fintech Engineering Handbook distilled from 6 years of tears, sweat and swears. 
    It’s a free ~25-page resource with various hints and patterns around handling money. 
    Tell me what you think!

other than that, peruse the commits on the source [1], or wait for the author to respond.

[0]: https://mas.to/@krever/116814803588993437

[1]: https://github.com/Krever/fintech-engineering-handbook/commi...

semantics become extremely relevant when "proxies" start caching.

mine's `scratch/`

hasn't tripped me up (yet)

> we brought down image creation time to mere seconds, even for images that were multiple GiB in size

this sounds interesting; for e.g., was wondering the other day if we could build images without actually pulling base images.. everytime we compile, we copy artifact(s) onto a multi-hundred MB base image which definitely doesn't need to be pulled everytime.

on youtube: https://www.youtube.com/watch?v=E7vFdy4BEAY

not sure if i saw the link in the blog; but the youtube video attaches TFA as the companion blog post.

> None of these are the most efficient way to do this (you can use git show and git log -S or maybe git grep to accomplish something similar), but personally I always forget the syntax and navigating a filesystem feels easier to me.

i feel like some of the old-school commands will benefit from long args, e.g., '--search'. at the time of writing, the current `git log` documentation[1]'s `-S' has _one_ instance of the word 'search'.

(un)related to the article, author went on to contribute documentation updates to git, which were much needed [2]

[1]: https://git-scm.com/docs/git-log#Documentation/git-log.txt--... [2]: https://jvns.ca/blog/2026/01/08/a-data-model-for-git/

slightly related, one of the more interesting issues i've faced due to mitm tls by the $job mandated CASB (cloud-access security broker)

is when python 3.13 [1] introduced some stricter validations and the CASB issued certs were not compliant (missing AKI); which broke REQUESTS_CA_BUNDLE/SSL_CERT_FILE for us

[1] https://discuss.python.org/t/python-3-13-x-ssl-security-chan...

thankfully more and more projects are supporting the "standard" SSL_CERT_DIR/SSL_CERT_FILE environment variables [1]

i think requests is a tricky one, as it _should_ be supporting it already based on the PR [2], but looks like it was merged in the 3.x branch and idk where that is, release-wise.

there is also native TLS on linux (idk what exactly you call it); but

    cp cert.pem /usr/local/share/ca-certificates/cert.pem && update-ca-certificates

all languages also seem to have packages around providing cert bundles which get used directly (e.g., certifi [3]), which does cause some pain

[1] https://github.com/rustls/rustls-native-certs/issues/16#issu...

[2] https://github.com/psf/requests/issues/2899

[3] https://pypi.org/project/certifi/

we recently moved to a similar approach, inspired by gondolin which does the same: https://earendil-works.github.io/gondolin/secrets/

an 'mitm' tls proxy also gives you much better firewalling capabilities [1], not that firewalls aren't inherently leaky,

codex's a 'wildcard' based one [2]; hence "easy" to bypass [3] github's list is slightly better [4] but ymmv

[1] than a rudimentary "allow based on nslookup $host" we're seeing on new sandboxes popping up, esp. when the backing server may have other hosts.

[2] https://developers.openai.com/codex/cloud/internet-access#co...

[3] https://embracethered.com/blog/posts/2025/chatgpt-codex-remo...

[4] https://docs.github.com/en/copilot/reference/copilot-allowli...

well, there was this, a while back: "experiencing a critical and recurring email delivery issue affecting recipients at outlook.com, live.com, hotmail.com, and msn.com"

"Emails to Outlook.com rejected due to a fault or overzealous blocking rules"

https://www.theregister.com/2026/03/04/users_fume_at_outlook...

discussed here: https://news.ycombinator.com/item?id=47246044

they should also charge a reasonably larger annual fee for reserving a short suffix and allow re-selling custom word prefixes..

inb4 "tailscale hurr durr",

if you are using tailscale already, with it setup as the DNS resolver,

you can setup NextDNS as the global resolver within tailscale[1];

i'm not sure exactly how much my latency's being affected, but am at something like 900k queries/mo and don't really notice it

[1] https://tailscale.com/kb/1218/nextdns

one of the non-intrusive approaches i have for this [1] is kubenetmon[2] which uses a kernel feature called nf_conntrack_acct to have counters for (src, dst).

it's not perfect [3] but gets the job done for me

[1] not as much "control" as it is "logging", of sorts; "especially when you just need to answer “what is my cluster talking to?”"

[2] https://github.com/ClickHouse/kubenetmon / https://clickhouse.com/blog/kubenetmon-open-sourced

[3] if you have a lot of short-lived containers, you're likely to run into something like this: https://github.com/ClickHouse/kubenetmon/issues/24

edit: clarifying [1]

it's an ad, for what?

i do not see a product upsell anywhere.

if it's an ad for the author themselves, then it's a very good one.

it'd be great if they can couple this with an SLA for GitHub actions so we won't have to end up paying as much..

(ofc, that'd only mean they stop updating the status page, so eh)

discussed 2 years ago,

https://news.ycombinator.com/item?id=38790597

4B If Statements (469 comments)

> Hey! I asked AI for this code, do you think this will work? I think you should use it.

unfortunately this problem preceeds AI, and has been worsened by it.

i've seen instances of one-file, in-memory hashmap proof-of-concept implementations been requested to be integrated in semi-large evolving codebases with "it took me 1 day to build this, how long will it take to integrate" questions