HN user

Timber-6539

123 karma
Posts4
Comments341
View on HN

A nitpick. The two managed docker volumes created (at the very bottom) are not used by the container and only serve to cause confusion to the reader.

  services:
    baikal:
      image: ckulka/baikal:0.9.5
      restart: always
      ports:
        - "XXXX:80"
      volumes:
        - /mnt/baikal/data:/var/www/baikal/config
        - /mnt/baikal/data:/var/www/baikal/Specific

  volumes:
    config:
    data:
[dead] 1 year ago

Can confirm. Was using free grok before it went down and I wouldn't be surprised if it came back behind a paywall.

The demo is the work. Social media views is where the productivity is being moved. And VCs are paying for this ball to keep rolling hoping to eventually cash out big some day.

AI is an irrational market at the moment and this is not going to change anytime soon.

AI has no meaningful input to real world productivity because it is a toy that is never going to become the real thing that every person who has naively bought the AI hype expects it to be. And the end result of all the hype looks almost too predictable similar to how the also once promising crypto & blockchain technology turned out.

I wouldn't put some configuration values like no-new-privileges:true in the global docker daemon config. Eventually you will find some app that will break because of this and you will spend hours troubleshooting it if you do not remember this tiny detail.

Something also has to be said for simplicity and redundant choices. For example replacing systemd-timesyncd with chrony is not justified. And some of the recommended sysctl values may be redundant and already the default in the target OS.

I have a better solution than what the author suggests. Accept that the American empire is on its last stages of a full on collapse. Every other empire before it eventually did anyway.

Zelensky lost big yesterday. The minerals deal was supposed to solidify a security guarantee from Uncle Sam. He bet on the wrong horse i.e Europe. Ukraine is facing assured destruction now if Zelensky continues on the foolish path of drumming up support for more war against the insurmountable Bear.

I respect Trump a lot more for having the fortitude to push for a peace negotiation, maybe we'll even be talking about a Nobel prize sometime next year.

So why did Trump invite a so-called dictator to the Oval Office? You are going to have a very long 4 years of Trump if you choose to remain willfully ignorant about what his administration is about or if you place more importance on his negotiation tactics over the results.

I bet this is all a part of Trump's strategy into pushing Europe into geopolitical irrelevance. And if it counts for anything, the Europeans did this to themselves by relying on the goodwill of America for their own security.

The code author could make a signature on every release which would be the strongest guarantee of authenticity. But at a rudimentary level, we could have code hosting repositories simply publish/advertise the sha256 values of the hosted code files.

The root of trust has to lay at the source code origin for a pure implementation of reproducible builds and for the security reasons I mentioned earlier.

In general it doesn't help much IMO to have distributions take a silo view of the problem. But those are just my ideas and thoughts on the matter.

If your builder is compromised, it can be co-opted to sign and verify the "source code" files with any values. The risk of placing this trust in the builder or the nix store is an easy one to avoid. Getting the authencity of the code from the source code independently ought to be the correct way of verifying reproducible builds.

That's no different from how NixOS does it. You are still comparing hashes from the first build done by the distribution. A more pure approach would be to use the source code files (simple sha256sum will suffice) as the first independent variable in the chain of trust.