Dedime

PREACH!

I run K8s at home. I used to do docker-compose - and I'd still recommend that to most people - but even for my 1 little NUC with 4vcpu / 16Gi Homelab, I still love deploying with K8s. It's genuinely simpler for me.

If anyone's looking for inspiration, my setup:

* ArgoCD pointed to my GitLab repos

* GitLab repos contain Helm charts

* Most of the Helm charts contain open-source charts as subcharts, with versions set like (e.g.) `version: ~0` - meaning I automatically receive updates for all major version until `1`

* Updating my apps usually consists of logging into the UI, reviewing the infrastructure and image tag updates, and manually clicking sync. I do this once every few months

My next little side project: Autoscaling into the cloud (via a secure WireGuard tunnel) when I want to expand past my current hardware limitations

The brilliance of the implementation of cooldowns: For someone to go download and run it, automated or otherwise, they simply follow the standard installation process.

Users who want take the extra precaution of waiting an additional period of time must decide to manually configure this with their tooling.

This practice has been a thing in the sysadmin community for years and years - most sysadmins know that you never install Windows updates on the day they release.

Having a step before publication means that's it's essentially opt-in pre-release software, and that comes with baggage - I have zero doubts that many entities who download packages to scan for malware explicitly exclude pre-release software, or don't discover it at all until it's released through normal channels.

Total meh from me, an end user. User of KeePass since at least 2015, I've written end-user guides, contributed to the main documentation, evangelize it to my family and friends when they have security questions.

I store every single important piece of info in my KeePass database. It stores ALL of my passwords, my SSN, credit cards, my health information, even some weird stuff like my vehicle maintainence records and whatnot. My KDBX file currently sits at 466K. Size is not a particularly compelling reason. Hate to be that guy, but if your database is much larger than that - you're probably doing it wrong.

Newer features like TOTP and passkeys are likewise not a concern for me. What did KeePassXC do when TOTP came around? They stored the relevant data in the attributes, and added a UI around it. It even works with my Steam TOTP, which is a nonstandard implementation. I haven't looked into it, but I imagine they did the same thing with passkeys. I don't see why this couldn't continue to be the paradigm they use. I don't use attributes at all - I haven't needed to, the notes section work great - but I do appreciate being able to look into the "raw data" of attributes quite easily, from within the UI.

If KeePass were being developed from scratch today, or if the developers of the various projects collectively really, really want to switch to a SQLite system of their own volition. Then sure, SQLite. I'm not going to ask them to do that now though.

---

On a separate note, an unfufilled niche that I have though, if anyone's looking for ideas. My secure password storage is a solved problem, KeePass is cross platform, easy to use, and very secure. What remains a problem is secure notes. I want to be able to write markdown (`.md`) documents, add photos and PDFs, then save it to a secure, encrypted folder somewhere. Doesn't need the same security posture as KeePass, but I don't want to leak metadata like file names.

Obsidian - my current notes app - is good from a usability standpoint, but it's not exactly secure. I could pair it up with Veracrypt, but that's a pain from a usability standpoint, and I don't trust my OS to keep the mounted Veracrypt volume contents a secret. Whatever the solution is, it must have a GPL license, or else I'm not going to trust it - from a long-term viability standpoint more than anything else.

If anyone has any suggestions here, would love to hear them.

Hot take alert! As an avid self-hoster, I'd like to hear why.

Personally, I self host because the benefits I receive simply aren't available anywhere else at the level of quality I've come to expect - Jellyfin is a great media player, it's free, and I don't want to switch. Pihole provides ad protection and privacy for my whole home network. It's also free. Homeassistant is amazing, and free. Etc etc.

Well, it's stored in an encrypted way - in the encrypted password database. Much like a password, everyone already knows not to share a passkey. But also like a password, as the owner, sometimes I want to look at it!

My problem with NixOS is the second you try to go "outside the guardrails", the difficulty increases 100x

Admittedly I didn't dive much into this to get the full context, but it's saddening to me that a legendary game designer had a GoFundMe. I was hoping achieving that level of status in a traditionally well-paid industry would leave one well off, financially.

I wouldn't say it's perfect quite yet. I just installed Debian on my Framework, and my microphone isn't working. Debugging it for the last 30 minutes has gotten me nowhere, and half the answers on the internet don't apply to my distro. Until basic issues like this go away or have easy solutions, it's hard to recommend it to anyone.

Maybe this is naive, but in a good crypto system, I would hope "when" is measured in millions or billions of years given current hardware capabilities.

I'll add my opinion as a DevOps engineer, not a startup, so take it with a grain of salt.

* Kubernetes is great for a lot of things, and I think there's many use cases for it where it's the best option bar none

* Particularly once you start piling on requirements - we need logging, we need metrics, we need rolling redeployments, we need HTTPS, we need a reverse proxy, we need a load balancer, we need healthchecks. Many (not all!) of these things are what mature services want, and k8s provides a standardized way to handle them.

* K8s IS complex. I won't lie. You need someone who understands it. But I do enjoy it, and I think others do too.

* The next best alternative in my opinion (if you don't want vendor lock in) is docker-compose. It's easy to deploy locally or on a server

* If you use docker-compose, but you find yourself wanting more, migrating to k8s should be straightforward

So to answer your questions, I think you can adopt k8s whenever you feel like it, assuming you have the expertise and are willing to dedicate time to maintaining it. I use it in my home network with a 1 node "cluster". The biggest pitfalls are all related to vendor lock in - managed Redis, Azure Key Vault. Hyper specific config related to your managed k8s provider that might be tough to untangle. At the same time, you can just as easily start small with docker-compose and scale up later as needed.

From someone who was recently tasked with "add service mesh" - make service mesh obsolete. I don't want to install a service mesh. mTLS or some other from of encryption between pods should just happen automatically. I don't want some janky ass sidecar being injected into my pod definition ala linkerd, and now I've got people complaining that cilium's god mode is too permissive. Just have something built-in, please.

People keep talking about having been hacked, but it's honestly baffling to me.

I'm 28. I started using computers on a regular basis when I was ~9 years old, playing RuneScape. Since then, I've spend probably 10s of thousands of hours on the internet - downloading torrents, signing up for sketchy Russian websites, doing online banking, testing experimental software downloaded over HTTP from a .xyz domain. I graduated high school, went to a technical college for compsci, graduated, worked in helpdesk, desktop support, IT management, and more recently DevOps. I develop software using all sorts of package managers, and used hundreds of thousands of unvetted software packages that arrived as dependencies.

Not once have I, or anyone I've been responsible for, been hacked. No crypto, no viruses, nothing. What the heck are you guys doing getting your Android phones hacked???? Like I only use a modicum of common sense these days, but I guess I've just been lucky and have been the odd one out. I still enjoy reading HN arrivals about security though, so maybe I just have always been slightly more security conscience?

In any case, this is just a stream of consciousness / gut feeling comment. Don't put too much weight into it, I haven't.

Aside from the point made by author - I visited Japan last year, I never had too much of an issue with garbage when visiting the major cities.

Most garbage was compactible and clean enough that I could stuff it into my garbage pocket (to the dismay of my girlfriend). Larger or dirtier items, I would put into a ziplock bag in my backpack that I carried with me everywhere. Public trash receptacles, while rarer than in North America, could be found often enough if you were observant of your surroundings.

I've used docker-compose, k8s, and NixOS myself, being from a similar technical background as the author, but I find myself disagreeing with some of the author's opinions on the technologies. They're not wrong of course, but I've had different experiences.

k8s: Installing and using k8s can indeed be a nightmare. In my job, we use Azure, so it's not so bad since launching a cluster is mostly handled by Azure. Setting it up for personal use is less fun. The mountains of YAML you can end up using to deploy even semi-complex services is even less fun. That being said, I've been wanting to use it for a personal project (distributed cluster using cloud VPSs and bare metal at home connected using WireGuard). I just wish it was smaller and faster. Most guides recommend 2Gb of RAM and 2 CPU for the smallest of small deployments.

docker-compose: I actually love docker-compose for my personal stuff. I have an intel NUC hosting homeassistant, pihole, caddy, deluge, jellyfin and a handful of other stuff. Everything lives in a series of folders for each service. Backups (both data and code via git), disaster recovery, and just general reasoning about of it is so easy. The docker-compose files are small and easy to read. I also find docker-compose to be about as immutable as you'd like it - version control your docker-compose directories, pin your image SHAs, and you're in a good place. Or don't, and it will still work pretty well.

NixOS: I've done it. I installed it on my Framework Laptop since it was all the rage at the t ime. I lived with it for about a year, and it was okay - for day-to-day use - AFTER I had spent weeks learning how to use NixOS. I will freely admit it's an awesome technology in some respects. But the documentation just was not there. It was way too hard to learn how to do even basic tasks. I thought nix flakes might be the "aha" moment I was looking for, but I gave up trying to get that to work after a couple of days of troubleshooting. Don't even get me started on trying to package up something from scratch. As a random example, I googled "packaging python for nix" and the top result [1] is just way too complex for something that should be pretty simple. The example includes some abomination of a .nix file with inline bash and python scripts.

I don't really know where I'm going with this. I really do like the idea of NixOS. I just wish it was much, much easier to reason about. Curious to hear what others make of this.

[1](https://nixos.wiki/wiki/Packaging/Python)

I also ran NixOS on my framework for a while. As much as I loved the idea of Nix, it's also incredibly hard - I work with Linux day in and day out for work, and finding my way around Nix, configuring new packages / basic features, etc. just took too long for me. The biggest upside I found was the incredible resilience, it was nearly impossible to break my installation.

I gave up after a short while using Nix and switched to Windows. It's not perfectly tuned like a minimal Linux install might be, but all of the hardware features work as expected and it has a pretty good battery life.

If someone can find a way to do something like Nix, but simple, I'll be interested. Even if it's just a on-rails version of Nix.

I applied for a job at a medical cannabis operation in Canada right before legalization hit.

I was curious to see if they had checked out my personal website, so I grabbed my webserver logs and I recognized one IP from the city the job was based in. More than likely, the public IP of the business in question.

On a whim, I ran the IP through Shodan.io and it showed that 47808 was open - The BACNet protocol. I had no idea what this protocol was, but I was able to download some odd enterprisey software that had the ability to speak BACnet. I connected to the IP:Port and found a long list of connected things - water levels, temperatures, lights, and more.

I wasn't interested in doing anything questionable with this information. I'm not even certain it allowed me to do anything more than look, but I like to think I could have e.g. turned off lights or adjusted temperatures in the grow rooms. I made the (risky) executive decision to let the hiring manager know that their public IP had an important port open to the world. I wound up getting hired by that business, and the first task I was assigned was to fix the open port.

I'm not sure if that counts as "hacking", but I was proud of finding the vulnerability / misconfiguration nonetheless.

I wrote a quick program in Go to move a certain file from my Downloads folder to my Google Drive folder, when the file is detected. It's to help me backup with Tiddlywiki.

KeePassXC is excellent, and available on MacOS / Linux / Windows

This whole LastPass kerfuffle has solidified my choice to continue using FOSS + self hosted password managers only. If my passwords get stolen, I'd rather be responsible for the loss than wait for a company to put out a squirrely statement.

As far as Jellyfin goes in my own experience:

- Supports phone / tablet / browser / roku / others

- Can chromecast

- Supports movies, tv. Not sure about random videos but I suppose you could do it.

- Supports subtitle downloading

- Haven't used it myself, but supports podcasts, books, photos, music

Also FOSS. Doesn't have the same motive as commercial software ala Plex to nag you, and it hasn't nagged me yet.

Oh good. I've considered working for Google, I think they work on interesting things, but I've recently adopted the stance that I won't take jobs that don't allow me the freedom to work 100% remotely. I value that freedom too much, and there's many other companies out there that let me do that.

TBH I find it completely wild that someone prefers PHP to a statically generated site (Assuming you can get away with statically-generated). Just serving static files is way way way faster than running a backend, not to mention all of the process efficiencies you get by not having to manage servers etc.

When I update my blog (statically-generated), I add an .md file containing the blog post, commit it to git, and push it to a git repo. A quick CI/CD build fires off which generates the HTML (~1 bash command in a docker container) and pushes the static files to a file server. Easy!

I surprised you didn't link Kelowna's finest newspaper, Castanet: https://www.castanet.net/news/BC/351544/Mudslides-close-all-...

I love them because their reporting is terrible and the site itself is straight out of the 90's. They used to run polls that were easy to manipulate, according to a ex-coworker of mine. It's like watching a train wreck in slow motion. Nonetheless, everybody in Kelowna acts like Castanet is the one true source of information...

Look into Cactus comments! https://cactus.chat/

Not affiliated. Just think it's cool.

I just don’t think that includes forcing them, or using the government to force them, to make changes to their software to suit you.

I don't want to force them to make changes! I want to force them to not make changes. These devices are not locked down by default, the manufacturer implements these locked down restrictions in software manually. Rip that out and I'll be happy.

For Irish people who wish to subvert this order, there's a handy concept in cryptography known as deniable encryption. Essentially, users (you) may convincingly deny that a plaintext version of encrypted data exists.

VeraCrypt, a source-available encryption program, supports this form of encryption, such that you can create an encryption file, say 1GB. You place a password on the "outer" volume, so that when you enter the password, it mounts the encrypted volume and it appears unencrypted. However, you also put into place an "inner" hidden volume. When you enter the password for the inner volume, it mounts a separate encrypted volume. Adversaries cannot detect this inner volume, and when they twist your arm to unlock the encrypted veracrypt file, you can enter the password for the outer volume, keeping the secrets of the inner volume safe.

This may be a little pie-in-the-sky, but I've found myself disliking the "upvote" or "like" mentality. Instead, maybe a "I use(d) this!" functionality, as well as talk sections for each routine?

I should probably just switch to using the autotype functionality built in, though much of my security concerns are allayed by the fact that KeePassXC prompts me in the application each time a website requests to use a password.

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices

1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOTP. Has a ton of "premium" features, totally free. It's awesome.

2. Syncing application: Google Drive. Sync your KeePass database using Google Drive (or whatever other sync application you want). KeePassXC supports merging databases if there's ever a conflict, as rare as those are. This is secure, because the KeePass database file is encrypted, and Google Drive / Google will never see the unencrypted database.

3. Password manager for phone: KeePass2Android. Not sure what the options are for Apple, but I'm sure they exist. Allows you to open your KeePassXC database from Google Drive.

4. Browser support: KeePassXC-Browser. Allows you to autofill your username / password / TOTP from your KeePassXC application to Chrome / Firefox.

Totally free, secure, convenient, and syncs to all your devices. Also comes with excellent redundancy for your password database so you'll never lose it. I've been using this setup for years flawlessly.

The code is calling out to a malicous URL for a script, downloading it, and executing the script. The malicious script from the URL is mirrored here: https://archive.is/TxFWj

Nobody has figured out exactly what it's doing quite yet, but you can paste that code into a Javascript deobfuscator and try to figure it out yourself: https://lelinhtinh.github.io/de4js/

Based off of reading the code for 5 minutes with my very poor javascript skills, it's modifying your searches via Google / Bing and redirecting you to a practically unknown search engine called "Blacksearch". Very suspicious. I found a reddit thread with others complaining about this search engine, https://old.reddit.com/r/edge/comments/kzwb6q/redirecting_to...