_wldu

Thank you, this is very helpful.

Anyone may purchase a domain name from a registrar (such as 'example.com'). That is not a 'lower platform'. It's just a domain name. Sure, it's not as popular as 'github.com' but in every other way (in the DNS) it is equal. And unlike github.com, you have full control of that domain and its DNS records.

There are no unique legal issues with regard to buying a domain name and writing and publishing source code on that domain. Using 'github.com' to host your source code does not give you more legal rights or protections. Copyright is copyright and a license is a license no matter where you publish it.

You should not be afraid to buy a domain, write source code and publish it there. It's not illegal to do that and you are not at more risk (although these big central social platforms would like for you to believe that).

That idea sort of proves that Github has evolved into a popularity contest/social platform. It use to be a git hosting company.

I have been thinking about closing my Github account and moving all my code to gitweb on one of my personal domains. I'm tired of the social/popularity contest aspect of Github and just want to write and publish code that I find interesting. I also want more control and I don't want my code used for AI research like co pilot. I thought about trying source hut, or something similar, but I feel it will end-up just like github once it gets more users.

Has anyone else setup a simple gitweb server on a personal domain? If so, how did it turn out?

You could probably use Twillo to make this work. It would require some coding to forward the SMS to email or post it to a website someplace where you could read it. I have done this in the past (outside of Antarctica) for 2fa that requires a certain DTMF tone be pressed and I only had an old Western Electric Model 500 phone at the time. Twillo worked great for that, but it's been years since I last did it.

https://www.twilio.com/docs/glossary/what-is-dtmf

https://www.twilio.com/code-exchange/forward-sms-email

The downside to doing what I did is it basically removes 2fa. You are back to a single factor as the 2fa is now automated and that may not be appropriate for many use cases.

I do this too. I can do anything with vim, Go and a Makefile.

They are probably trying to reduce SIP abuse. It's a big problem.

Put the checksums in a separate system such as the DNS. Use DNSSEC on your domains. Manage your DNS system as an isolated system (don't mix your HTTP/Email/Other stuff with your DNS provider). Now, users may verify the downloads you provide at your website by getting checksums from the DNS.

DANE may be of interest here as well:

https://www.infoblox.com/dns-security-resource-center/dns-se...

Every language dreams of being faster and safer than C and C++. Can't have it both ways.

Nice, this Go version satisfies gofmt:

https://github.com/62726164/quine

The complexity of C++0x is one reason Go was created.

"For me, the reason I was enthusiastic about Go was just about the same time we were starting on Go, I read (or tried to read) the C++0x proposed standard. And that was the convincer for me." - Ken Thompson

17:45 mark here: https://www.youtube.com/watch?v=sln-gJaURzk

I agree 100%. Massive frameworks with massive complexity. I don't enjoy them at all. That's one reason I like Go. It's very modern, but I can still use vim and a simple Makefile to control it.

It may be useful for websites to make these logs public. The logs would show the exact time, the IP and the specific abuse.

In my experience, a lot of 'threat intelligence' data has a mysterious origin and is marginally useful. Yes, Tor exit nodes do bad things. Thank you, we sort of already knew that.

But I'm not sure that's really beneficial either. It would be interesting to observe trends (such as log4j) and we could see first hand how Tor exit nodes are used for abuse and maybe collect a large list of 'known bad' IPs.

Also, when we say an IP is bad (because it was observed doing a bad thing), how long do we keep it on the naughty list? 24 hours? More? Less? It may have been dynamically assigned and later some 'good' person will come along and want to use it to browse the web. If the IP is still on the bad list, that person will potentially be blocked by over zealous 'security professionals' who don't understand or don't care.

What other uses could be made of this type of log data?

I agree 100% with this statement (and with the article in general):

    “Basic hygiene” is arguably better than any of these bolt-on option, including things like:

    * Knowing what dependencies are present
    * Being purposeful about what goes into your software
    * Choosing a tech stack you can understand and maintain
    * Choosing tools that are appropriate for the software you are building

If it earns 20 million + each year, I'd leave it alone.

Off topic... What's the best way to easily recycle these batteries? I normally disassemble my old phones and securely dispose of the chips (for my privacy), but the batteries are glued in with a strong adhesive. Just trying to remove them can start a fire. I think most people just throw the old phones in the trash, but I don't like to do that. It's bad for the environment and potentially dangerous to trash workers.

It seems that phone manufacturers should make the batteries easy to remove, replace and recycle. Not sure why they do not do this.

Home Depot has drop offs for old batteries, but last time I was there they told me they were for power tool batteries only now.

The Design Flaws of Password Managers - https://www.go350.com/posts/the-design-flaws-of-password-man...

One example I like to use (when talking about entropy):

A four digit numeric PIN (that we know) has 0 bits of entropy. There is no uncertainty about what the PIN actually is. A randomly selected one (that we do not know) has just over 13 bits.

print(math.log(10)/math.log(2)*4)

13.28771237954945

The more entropy, the more uncertain we are.

However, humans are not random. We use the year we were born, some keyboard sequence or some other predictable number as our PIN. We don't know exactly how much entropy these PINS have (there is some degree of uncertainty), but we do know they are significantly less than 13 bits.

I still see them. They come and go, but are always present at some level.

    2022-08-29T17:35:12.617Z [DEBUG] sshlog gen 113.61.219.237 admin admin SSH-2.0-HELLOWORLD
    2022-08-29T17:48:17.879Z [DEBUG] sshlog gen 218.92.0.190 root poohbear SSH-2.0-PUTTY
    2022-08-29T17:48:18.041Z [DEBUG] sshlog gen 218.92.0.190 root p@ssw0rd3 SSH-2.0-PUTTY
    2022-08-29T17:48:18.2Z [DEBUG] sshlog gen 218.92.0.190 root p@ssword! SSH-2.0-PUTTY
    2022-08-29T17:50:13.507Z [DEBUG] sshlog gen 185.191.205.92 hl hl SSH-2.0-libssh-0.6.3
    2022-08-29T17:52:57.28Z [DEBUG] sshlog gen 138.68.91.192 victoria abc123 SSH-2.0-libssh-0.6.3

I agree. It's also an ISO standard that IMPO, will be in use for the next 50 to 100 years. Modern C++ is very safe and very fast and very mature.

I would also recommend Go for web developers who want both speed and memory safety. It works well and is hard to beat, but I haven't seen any Go web framework that comes close to Ruby on Rails. If anything like that ever does come along, I think it will be very popular.

I like Ruby a lot. I'm not knocking it. It's probably the most enjoyable language I've ever used.

I agree with your suggestion. I think Post Offices, DMVs, and large reputable retailers (Walmart, Target, Cellular Phone companies, etc.) could verify our identities for a small fee and help us reset our social accounts when needed. I arrived at the same conclusion and wrote a blog post about it a few years ago:

https://www.go350.com/posts/now-they-have-2fa-problems/

That looks like nftables (the successor to iptables).

Here's a landlock wrapper for FireFox: https://github.com/62726164/misc/tree/main/go/landlock/firef...

It's more restrictive than Firejail and is not suid.

If you are not modifying/editing the files (just reading them) and you run Linux, then do this:

1. Don't allow users to sudo.

2. chmod the files to 400 (read-only) as the normal user.

3. chattr +i the files (as root) to prevent modifications. This makes the files immutable (cannot be changed).

So if ransomware (running in the context of a normal user) gets onto the machine, it cannot encrypt the files.

Hope this helps.

It's been my experience that IT management want to see metrics and dashboards for everything. The want to be able to plan, allocate resources, and justify purchases and staff.

How many of these did we do, how many of those, how long did it take to close this type of ticket, etc. So while the technical people could fix things on the spot, they are not allowed to due to the demand for metrics and tracking.

I can see both sides of the debate, but there needs to be a good balance. We can get stuff done and provide metrics without too much overhead.

Be clear on what is expected. Have weekly deliverables and weekly team meetings. Don't micromanage them or have them meet each day. Get them off to a good start (give them all the gear and info they need to do the job) and be very explicit in what is expected. Give them a few weeks to get acclimated, then hold them accountable.

Whether they are remote or in the office, they can be successful. If they are getting their deliverables in on time and do things the way they are asked to do them (follow these simple rules)... that's all that matters.

And when I say follow the rules, I mean that I don't care if they use vim, emacs, nano, Wordpad, Windows, MacOS, Linux, etc. But I do care about how they submit a merge request and whether or not they PGP sign their commits.

Maybe he works for a company that does US government research? Maybe they require NIST approved algorithms. I'm pretty sure that would prevent the use of Age for file encryption.

Use the DNS: https://www.go350.com/posts/age-file-encryption/#age-pki-iss...

IGA is a supermarket chain. Granted, it's like the older, smaller ones (it's not a Walmart Jumbo Center) but it's still a supermarket.