vbezhenar

Few fixes:

1. "ИМЕНА" is plural, so instead of "NAME:" it's a bit more appropriate to use "NAMES:". Probably should be "VARIABLES" or "VARS" in modern context.

2. You've got few typos mixing "R" and "P". Should be "R" everywhere.

3. Instead of "ALL" you should use "DONE".

4. Instead of "KNC" you should use "END".

So it would look like this:

    FUNC FACT (N);
      NAMES: R;
      1 -> R;
      FOR I FROM 1 TO N ::
        R * I -> R
      DONE
    RES: R
    END;

    FOR N FROM 0 TO 6 ::
      ? "FACT(", N, ") = ", FACT(N)
    DONE;

I live in Kazakhstan (I assume that's one country nobody heard of and would disable in their dashboard) and my bank doesn't even have any UI for chargebacks, nor I ever heard about anyone doing chargebacks. They even explicitly warn me sometimes that I assume all responsibility for that payment. I guess I can go through some process, it's VISA after all, but it's definitely not something I can do easily.

Here's quote from the article:

> Note from 2024: This article was published on March 16th, 2014. It is still correct in its discussion of entropy and randomness, but the Linux kernel random number generator has been reworked several times since then and does not look like this anymore. Good news: the separation between /dev/urandom and /dev/random is practically gone.

My understanding is that on modern Linux system:

At early boot phases, /dev/random can still block, because not enough entropy has been seeded yet. /dev/urandom will not block, but the random data might be of poor quality and not suitable for crypto purposes. This happens very early in the boot, so probably it's not even possible to run user stuff at this time. At least on my laptop, the message "random: crng init done" gets logged almost instantly after boot and long before even initrd starts. Might be different for exotic platforms, I guess.

Once there was enough entropy seeded, both /dev/random and /dev/urandom works identically, they don't block and they return high quality random data. So for most userspace purposes, these files can be used interchangeably, one is not better than another.

It is a pity that your Linux experience is spoiled by so many bugs. I just want to say that I'm using it for recent years and encountered none of the issues you mention. In fact, my overall experience is butter smooth, regarding hardware support.

Right now my laptop is connected to 4K Dell display and it works perfectly in clamshell mode. I never saw any random lines across the middle of display, GPU acceleration seems to work fine, WebGPU in my Chromium browser works fine, video decode accelerated so 4K video eats a tiny bit of CPU. I can't say anything regarding color depth, everything seems to work fine for me. My display reports "3840x2160, 60Hz 30bit" info. I'm using 2x scaling and fonts are rendered properly (not blurry) in all applications I'm using.

My WiFi is configured using NetworkManager, I don't have iwd installed and systemd-networkd is not enabled. It somewhat helps that I'm using Arch and I decide what to install and what to enable.

I agree that Android provides much more polished system and I'd be happy to switch to desktop Android if that ever will be a thing. I don't like Linux desktop. It's just the only desktop operating system that does not suck for me.

You want Linux.

Hardware features are contained in the kernel. GUI has nothing to do with them.

GUI frameworks provide features for applications to draw their UI.

A selection of numerous windows managers and desktop environments allows you to choose the best GUI shell to work in.

It is somewhat of a bazaar, with different components sometimes not fitting perfectly into each other and there's a constant migration to a best new thing, whether it's systemd, pulseaudio, wayland or pipewire, but generally things work OK and it's not like Windows today offers a significantly different experience.

Windows is beyond salvation at this point.

You switch your position, the back becomes a seat and vice versa. Gotta be hard to execute in a limited space, so probably you're not even supposed to do that while being inside.

TBH I never understood people trying to run LLM locally. Just rent a powerful machine in the cloud for few hours. It's cheap enough, because you don't need to own a hardware. It doesn't introduce a dependency because there are hundreds of hosters. It doesn't compromise your data, because nobody would extract data from your VM, not until you're under an investigation, anyway, and even in that case just use different jurisdiction.

Spending humongous amount of money to get machine that'll felt obsolete in 2 years? I don't know.

Run vaultwarden locally. Install bitwarden. Now you have software-only implementation of passkey. Dig into vaultwarden sqlite database and you'll find passkey data there. Extract and save it on disk and you have exportable passkey. See, it's all security theater without remote attestation.

I had an idea to create blatantly insecure passkey browser extension. Maybe I should do that.

Can you revoke certificate for a specific device using privacy schemes?

Like imagine that someone managed to extract key from the specific device and distributed that key in a software implementation to fake attestation. Now Google needs to revoke that particular key to disallow its usage. This is obvious requirement.

1. Assuming managed service, it frees me from host OS management. So basically the same proposition, as good old "PHP+MySQL" hosters. You upload your website, they make sure it works. But without limitations and with much better independence.

2. It allows me to configure everything using standard manifests. I need to provision the cluster itself initially, then everything could be done with gitops of various automation levels. I don't need to upload my pages via FTP. My CI will build OCI image, publish it to some registry, then I'll change image tag of my deployment and it'll be updated.

3. It allows to start simple, and extend seamlessly in the future. I can add new services. I can add new servers. I can add new replicas of existing services. I can add centralized logging, metrics, alerts. It'll get more complicated but I can manage the complexity and stop where I feel comfotable.

4. One big thing that's solved even with the simplest Kubernetes deployment is new version deployment with zero downtime. When I'll update image tag of my deployment, by default kubernetes will start new pod, will wait for it to answer to liveness checks, then redirect traffic to new pod, let old pod to gracefully stop and then remove it. With every alternative technology, configuring the same requires quite a bit of friction. Which naturally restricts you to deploy new versions only at blessed times. With Kubernetes, I started to trust it enough, I don't care about deployment time, I can deploy new version of heavily loaded service in the middle of the day and nobody notices.

5. There are various "add-ons" to Kubernetes which solve typical issues. For example Ingress Controller allows the developer to describe Ingress of the application. It's a set of declarative HTTP routes which will be visible outside and which will be reverse-proxied to the service inside. Simplest route is https://www.example.com/ -> http://exampleservice:8080, but there's a lot more to it, basically you can think about it as nginx config done differently. Another example is certificate manager, you install it, you configure it once to work with letsencrypt and you forget about TLS, it just works. Another example is various database controllers, for example cloudnativepg allows you to declaratively describe postgres. Controller will create pod for database, will initialize it, will create second pod, will configure it as replica, will perform continuous backup to S3, will monitor its availability and switch master to replica if necessary, will handle database upgrades. A lot of moving parts (which might be scary, tbh), all driven by a simple declarative configuration. Another example is monitoring solutions, which allow to install prometheus instance and configure it to capture all metrics from everything in cluster along with some useful charts in grafana, all with very little configuration.

6. There are various "packages" for Kubernetes which essentially package some useful software, usually in a helm charts. You can think about `apt-get` but for a more complicated set of services, mostly pre-configured and typically useful for web applications. The examples above are all installable with helm, but they add new kubernetes manifest types, which is why I called them "add-ons", but there are also simpler applications.

Just for the record, I don't suggest that to everyone. I spent quite a bit of time tinkering with Kubernetes. It definitely brings a lot of gotchas for a new user and it also requires quite a bit of self-restrictions for experienced users to not implement every devops good practice in the world. Sometimes maybe you don't even want to start with ingress, I saw cluster which used manually configured nginx reverse proxy instead and it worked for them. You can be very simple with Kubernetes.

How do you solve persistence with swarm? Can I deploy postgres with network storage that will mount automatically on node where container is launched?

Regarding cleanups: I'm using flux CD with kustomize. It tracks resources that it created. If I delete manifest from my repository, flux will delete resources that were created from these manifests. For me that's pretty much the ideal workflow.

Regarding hooks: I don't know. All applications that I've used, implemented migrations internally (it's usually Java with Flyway), so I don't need to think about it. One possible approach could be to use flux CD with Job definition. I think that Flux will re-create Job when it changes. So if you change image tag, it'll re-create Job and it'll trigger Pod execution. But I didn't try this approach, so not sure if that would work for you.

I don't understand you.

For very simple deployments, you don't need anything at all. Just write manifests and use `kubectl apply`. You can write `deploy.sh` but it'll be trivial.

If you want templating, there are many options. You can use `sed` for the most simple templating needs. You can use `cpp`, `m4`, `helm` or `kustomize`. I, personally, like `kustomize`, but `helm` probably not the worst template engine out there.

Kustomize is even somewhat included into basic kubernetes tooling, so if you want something "opinionated", it is there for you. It works.

> Ingress is being deprecated

Do you have any links about Ingress being deprecated?

Official docs here: https://kubernetes.io/docs/reference/kubernetes-api/service-...

There are no mentions about this API being deprecated.

Yeah, I spent quite a bit of time learning Kubernetes, but now I'd use it to host a static webpage on a single server, over alternatives. It's so awesome.

These stories make me rethink my approach to infra. I would never run AI with prod access, but my manager definitely has a way to obtain prod tokens if he really wanted to. Or if AI agent on his behalf wanted do. He loves AI and nowadays 80% of his messages were clearly made by AI. Sometimes I wonder if he's replaced by AI. And I can't stop them. So probably need to double down on backups and immutability...

I hate that feature and I hate that they keep bloating browser which was lightweight.

Just for the record.

Just wait a month, Opus 4.8 will comprehend it for sure.

data:text/html,%3C%68%31%3E%64%61%74%61%20%55%52%4C%20%69%73%20%6E%6F%74%20%77%65%62%20%73%63%61%6C%65%3C%2F%68%31%3E

Nothing wrong about running http server on your localhost and talk to it. A lot of applications do that. The best thing: you don't need to appease extension appstores, you just ship.

The only nuance is that recent chrome versions treat it as a separate permission, so user need to allow it once.

Yes, native messaging is the "proper" way to do that, but, again, nothing wrong with localhost http server. You have origin headers so you can allow access from your whitelisted website, if necessary.

Nitpick, but I'd suggest to use "OCI Image" terminology. It runs with podman just fine.

This page is confusing and maybe even misleading. They write "Linux first". Few paragraphs later they write: 20 hours, Netflix 4K streaming, 250nit brightness, 30% volume, Windows 11. Why didn't they stream Neflix on Ubuntu they ship with?

Overall it looks awesome. I just bought Thinkpad T14s upgrading from the same model of older generation, I wish Framework would expand its sales coverage, probably would buy it without second thought if it was available in my country without overseas shipping and customs tax hurdles.

If that's the case, what will happen after IPO? Will they become good again?

Yeah, I bought it and it collects a dust since then. Fun device but I have no idea how to use it in my life.

They already killed Firefox. It has 2% marketshare. Next to something called "Samsung Internet" LoL. They're not in position to force technology usage.

Chrome has the option to turn off APIs by default. I do it for my installs. I think that disabling that option for everyone is not a good approach as average user will never figure out how to enable it, making that technology effectively dead, so we get back to installing host software.

Sometimes security and usability contradict with each other.

The issue with Web Serial is it's not available for Android. Because for some dumb reason, android apps can't access /dev/ttyUSBx, even if kernel exposes them. But then can access raw USB devices. That's really weird. But if you need to access USB serial device in an android, you need to implement FTDI proprietary protocol or whatever adapter you're using by hand.

If you're worried about that, you can just disable WebUSB in the chrome settings. Any website will be denied access to that API from now on. And what's even better: you can selectively enable WebUSB for some websites.

That's what I do and that's what I suggest for any security-conscious user to do. Just explore Chromium settings, there are dozens of various APIs that could be disabled. Do you need Web MIDI? I don't. Disable.

Won't work as a default setting for average user for sure, but if you consider yourself an advanced user, do that.

Are you more comfortable with installing native apps to control your hardware? Or you are more comfortable with opening a webpage to control your hardware?

With WebUSB implemented in major browser, you can be sure that they took extraordinary attention to all security implications.

With some random application from tiny developer, can you be sure about that?

I know for sure, that I prefer a webpage isolated in the browser for anything that could be done in a browser. I'm very hesitant to install anything locally.

Modern Windows also allows raw USB access for devices exposing specific WinUSB descriptor. So it's not just any device, but if it's yours device and your skills are sufficient to alter USB descriptors that device presents to the host, it's pretty painless.