HN user
Don't bother with cookies at all unless they serve the interests of the user. And in that rare case, only do a cookie banner if required by law, and here's how to do it: just pretend it's "fine print." Make it functionally invisible, but good enough to get away with it. Nobody will complain about your cookie banner not being annoying enough.
Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default.
When pq key agreement was added in 2019, it took almost 3 years for it to become enabled by default. This isn't criticism, just an observation. I don't have a pressing need for pq sigs. Always happy for new OpenSSH releases though!
It's always the most insufferable people that make the biggest hullabaloo about a project they have nothing to do with and have never contributed to.
Agreed, and similarly, as a hobbyist programmer who loves Rust and Go, I've always felt that the people who command others to "rewrite it in xyz" are not themselves developers, they're "ideas people." There's a mass of these people whose main interactions with the world are through the dramatic forcing of their correct opinions.
I run a smallish project with ~1k stars and I've stopped maintaining it last year because people feel like they're absolutely owed features or bug-fixes or whatever.
That's a bummer and it's something I'm fearful of. I post some code on my website, not on a github type site, and don't interact with people about it. It's nice and plenty of people do it. Is that something you'd consider?
Will Prowse has a very active, high quality Youtube channel about DIY solar where he talks about all things solar: generation, safety, cabling, inverters, batteries and more.
It's been a while now but once out of curiousity I tested the text to speech functionality (with my eyes closed) on an iPhone and another device (a laptop maybe?), and found iOS to be more advanced but still lacking. I don't know much about this but it's nice to see improvements. GrapheneOS seems to be a high value project in terms of dollars-to-output.
No, it doesn't.
I think some people may not be reading closely. On Unix, "/etc/services" is a file, not a directory:
$ file /etc/services
/etc/services: ASCII text
rsync -av -e ssh /etc/services example.com:/tmp/services
The above command creates a mirror of the local file /etc/services in a remote file called /tmp/services. The outcome is exactly the same as if I had run "scp /etc/services example.com:/tmp/services"
client$ sha256 -q /etc/services
469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a
server$ sha256 -q /tmp/services
469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a
The above command creates a mirror of the local file /etc/services in a remote file called /tmp/services/services. The outcome is NOT the same as if I had run "scp /etc/services example.com:/tmp/services"
Please note that "/tmp/services" and "/tmp/services/services" are different.
client$ sha256 -q /etc/services
469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a
server$ sha256 -q /tmp/services
sha256: /tmp/services: read error: Is a directory
server$ sha256 -q /tmp/services/services
469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a
rsync -av -e ssh /etc/services example.com:/tmp/services
The above command creates a mirror of the local file /etc/services in a remote file called /tmp/services. The outcome is exactly the same as if I had run "scp /etc/services example.com:/tmp/services"
If you disagree, please state what operating systems you're using and copy/paste the output of the following commands on each side:
uname -a
rsync -V
openrsync -V
$ rsync -V
rsync version 3.4.3 protocol version 32
(snipped)
$ openrsync -V
openrsync 0.1 (protocol version 27)
openrsync --rsync-path=openrsync -av -e ssh /etc/services example.com:/tmp/services
And then type "file /tmp/services" on the remote server.
Was there already a /tmp/services directory on the dest?
No. And just to make sure, I ran a quick 'rm -rf /tmp/services' on the remote host, then re-ran openrsync on the client. Same result. This is OpenBSD 7.9 on both sides.
And I 100% agree about trailing slashes.
I've been using openrsync here and there since it was announced and it's definitely improved over time. I'm looking forward to when I can use it exclusively.
The one place in my usage where it doesn't match Samba rsync is with the following:
openrsync --rsync-path=openrsync -av -e ssh /etc/services example.com:/tmp/services
I would expect openrsync to create a remote file /tmp/services, but instead it creates /tmp/services/services.
Normal directory mirroring as in -av -e ssh /path/to/src/ example.com:/path/to/dst/ works as it does with Samba rsync.
Gandi was so great, once. No upselling, whois privacy by default before it was normal, good prices. I had a domain with them 25 years ago so I was a longtime customer, but never again.
Good writeup. I only used Gandi as a domain registrar so I was only familiar with the insane cost increases. What a terrible company:
Gandi now informed them that their email would be suspended unless they paid extra, effectively retroactively changing the terms of a service already paid for.
I would also love to hear specific opinions about VeraCrypt because I need to get some Windows users to encrypt some of their seldom-used sensitive files, like HR for example.
They can't use age or any other "right answer" tools. I'm talking about people who don't know their own username, people who don't know that their Windows password is the one they use to log into Windows. "Is that for my email?" Just getting them to use a password manager is like arm wrestling an aligator. If VeraCrypt isn't the best option for them, then what is?
I recently started using Thunderbird for work which uses O365 (horrific service) for mail. I've found that 2FA with O365 to be totally unreliable no matter the client, even using the iOS app.
Does anyone use Thunderbird with Gmail and 2FA, and does it work correctly 100% of the time there?
Watching with a big public group of people you mostly don't know but maybe should is a special experience. This may depend on region, but in the US there used to be frequent midnight openings for superfans like myself. People dress up in costumes, local shops hand out prizes and it's an event. Saw Phantom Menace this way, LOTR, Watchmen, and maybe others, but I haven't seen a midnight opening offered in years. Maybe the theater managers are swimming in the pool on the roof.
Why would you think that? Solar and wind are both far cheaper than fossil fuels even ignoring the problems caused by coal and methane.
I've been thinking a lot about organizing an installfest sometime in the next year or so, which would be my first time in over 20 years. To anyone with current experience running one, do you have any advice?
I'm also interested in smartphone operating systems like Ubuntu Touch and postmarketOS etc.
Thank you for posting this - I had to disable Lockdown Mode because of this issue.
Also maybe of interest is that the new cdb subdomain is using pqconnect instead of dnscurve
This is not correct. There isn't a cdb subdomain because cdb.cr.yp.to doesn't have NS records, which is where DNSCurve fits in. If you have a DNSCurve resolver, then your queries for cdb.cr.yp.to will use DNSCurve and will be sent to the yp.to nameservers.
From there, if you have pqconnect, your http(s) connection to cdb.cr.yp.to will happen over pqconnect.
Maybe the confusion is because both DNSCurve and pqconnect encode pubkeys in DNS, but they do different things.
Here is DNSCurve:
$ dig +short ns yp.to
uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to.
$ dig +short cdb.cr.yp.to
pq1htvv9k4wkfcmpx6rufjlt1qrr4mnv0dzygx5mlrjdfsxczbnzun055g15fg1.yp.to.
131.193.32.108
In some cases yes, replacing an old machine with a new one can be an evironmentally responsible choice. But in general that's not the case and one should thoughtfully consider the variables including but not limited to software choice, grid carbon cost (see Electricity Maps below), embodied carbon cost of materials, environmental issues of mining and production not strictly related to climate emissions, and more.
Low Tech Magazine wrote an article about this here:
https://solar.lowtechmagazine.com/2020/12/how-and-why-i-stop...
Apple News is loaded with ads, so this wouldn't surprise me. iOS already has ads.
I just installed Open Street Map (the iOS app is called OsmAnd) and it looks nice! Zoom in/out is much better than on Apple Maps. A quick check of a route I know produced a good map, so I'll start using OSM from now on.
Note that GP used "whilst" which is British English, and previous posts seem Euro-centric and talk about renaming "American football." So it sounds like this person is Europe's problem.
The post had a number of grammatical errors too, so if "whilst" we're at it, should we criticize all of European education? Please don't post low-effort negative nationalism. It's cheap and the subject (the richest person alive is apparently a nazi) is a serious matter.
I was surprised how little it costs to stop climate change.
If you read Drawdown, you'll see that it doesn't cost money to stop climate change, it saves money.
Executable file integrity enforcement
I assume but don't know for sure that this refers to Veriexec in NetBSD, and I'm not sure what in HardenedBSD. Anyone know?
https://man.netbsd.org/veriexec.8
My understanding is that Veriexec isn't enabled by default - the manpage says only that "[s]ome kernels already enable Veriexec by default." If you have this enabled, how do you upgrade binaries? The manpage says that in strict mode 1, write access to monitored binaries is allowed but then access is denied. So I assume that after file modification, root then runs veriexecgen and veriexecctl load as mentioned in the manual to update the signatures list. So it seems that strict level 1 isn't functionally different from a read-only /usr or even just root-owned binaries. In either case, you just need root to update targeted binaries. Surely I'm missing something and would appreciate some insight.
At a glance as an outsider, stricter modes appear somewhat functionally similar to "chflags schg" on BSD systems, where more work is needed to get around restrictions. In the case of schg, you have to reboot into single user mode, remove the schg flag, then modify the binary, and continue booting into multi-user mode. You could do this as a remote attacker (as in not having console access) depending on what boot files are or aren't protected with schg, but modifying all the necessary files can be a source of new problems.
Pre-shared keys are just inconvenient to handle safely.
You can transfer PSKs safely and easily with OpenSSH 9.0 (released 2022-04-08) or later, which uses sntrup761x25519-sha512@openssh.com as the default key exchange method.
The ships in service show a reduction in fuel consumption, and thus a similar drop in emissions, of between 5% and 25%, says Tuomas Riski, the firm’s outgoing ceo. Each rotor costs around €1m, which he says can be repaid in fuel savings over three to ten years.
After six months at sea the WindWings have cut fuel consumption by about 15%, although the company reckons three sails could cut average fuel use by 30% or more.
Oceanbird reckons the sails could deliver 50-60% lower emissions compared with conventional vehicle-carriers.
Airseas tested a Seawing last year on a k Line cargo ship. They are expected to reduce carbon-dioxide emissions by some 20%, says k Line.
These are consistently good results across a range of carriers. If the industry moved to these sails, the aggregate emissions drop would be significant.
Yes, I run -current so I update packages frequently.
After tedu's comment here I installed 7.5 in a VM and could build and run my Go software in it successfully, so I figured there were some Go build or config files or something somewhere getting in the way. I pkg_delete'd go, removed every Go build/config file I could find, and re-added Go with pkg_add. Now I can build apps with the previously mentioned modules; everything works fine now.
Thank you for the responses. :-)
I'm currently switching my Go code to Rust in part because of the syscall related Go trouble:
Users of syscall(2), such as Perl and the Go programming language were converted to use the libc functions.
I think the following may still need to be converted:
* unix.Pledge from golang.org/x/sys/unix
* unix.Unveil from golang.org/x/sys/unix
* terminal.ReadPassword from golang.org/x/crypto/ssh/terminalIf you have a security feature for example, which uses the pledge() syscall on OpenBSD, but you can only use that feature on OpenBSD systems, you have two choices:
Just in case, I want to note that pledge(2) and unveil(2) are also supported by SerenityOS, so checking only for an OpenBSD target is insufficent.
https://awesomekling.github.io/pledge-and-unveil-in-Serenity...
Pledge and unveil in SerenityOS, combined with the planned move to memory safety, will be a powerful combination.
dq - Recursive DNS/DNSCurve server and command-line tool to debug DNS/DNSCurve
I use dqcache, the DNSCurve-aware recursive resolver from the dq package, and love it.
.io used to be trendy but no more, and now some people feel stuck on expensive domains.
Although my first thought was also the climate emissions, we have to be careful with these numbers, as 1kWh of electricity in Sweden is very different from 1kWh of electricity in Poland.
https://app.electricitymaps.com/map
Poland is about 30x dirtier than Sweden. World numbers vary all over the place.
Similarly for beef - are the cattle raised under conventional agriculture (with maximum emissions) or regenerative agriculture (with minimum emissions)?
By my rough count, an example round-trip flight for this trip is about 2600 miles (~4200km) with an approximate climate cost of about 1100kg per person. This accounts for the fact that airline emissions do roughly 3x the damage as expected (compared to ground transportation) as contrails form cirrus clouds which "are too thin to reflect much sunlight, but ice crystals inside them can trap heat. Unlike low-level clouds that have a net cooling effect, these contrail-formed clouds warm the climate... A 2011 study suggests that the net effect of these contrail clouds contributes more to atmospheric warming than all the carbon dioxide (CO2) produced by planes since the dawn of aviation."
https://www.science.org/content/article/aviation-s-dirty-sec...
We have ways to make electricity and food carbon-cheap, and potentially even carbon-negative, but the same is not currently true for flying. I think we should move to passenger ships for transoceanic trips and electrified trains for overland travel.