dvzk

Same. I learned Tcl recently for /usr/bin/expect. I wasn't happy to be forced into using yet another esoteric language, but Tcl itself is strangely fun: it's like a more expressive and functional Lua.

WireGuard is extremely easy to setup. It's difficult to manage if you have hundreds of nodes or dynamic endpoints: that's what Tailscale and Netmaker helps with.

OpenBSD's wg documentation is straightforward. It maps onto wireguard-tools' configuration concepts if you need to use Linux.

1. https://man.openbsd.org/wg.4

2. https://man.openbsd.org/ifconfig.8#WIREGUARD

3. https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8

With OpenBSD you will typically end up with a hostname.wgN config that looks like this:

  inet6 fd00:abcd:efgh:ijkl::1/48
  wgkey <base64-private-key>
  wgport 51820
  wgpeer <base64-peer-pubkey> \
    wgpsk <base64-secret> # optional \
    wgaip fd00:abcd:efgh:mnop::1/64 \
    wgendpoint x.x.y.y 51820
  up

You would also be locked out if you ran OpenSSH on Tailscale's autoconfigured WG interface. Setup WireGuard manually, or enable serial console login, or make sure your servers are dispensible. Tailscale (and Nebula) mostly alleviate the last case.

I wore mine while riding a hardtail XC mountain bike (on safeish trail segments) and the transparency mode failed after 7 months. After that, the non-ANCed speaker and microphone worked fine. Weirdly durable for nonathletic purposed hardware.

I'm more tempted to stop running again. I am less skilled at mountain biking today since I moved to a 1:3 weekly schedule (4h running and 6-16 hours riding). Our insane single friend who XCs from summit to summit 7-14 days straight 3mo/year is enjoying my conjured dream.

Health isn't my goal, it's a second-order effect. I just know that you can achieve top 1% fitness without the time-consuming yoga and gym routines.

I don't think that's reasonable at all. I ride and trail run regularly, and the amount of time that it subtracts from my nerd hobbies is *immense*. Other poster is right, the 99th percentile regular non-professional shredded athletes I know do one thing consistently.

Common gear ratios for MTB (and gravel) do favor steep inclines much more. It doesn't matter how exhausted you are, if you have a granny gear 46-52t cassette and 30-36t chainring setup, you're solid.

Nice! I didn't know about miniroot*.img. It's actually just bsd.rd, boot, MBR+PBR, and bootx64.efi. Nothing that can't be safely overwritten while the ramdisk kernel is running.

QEMU most likely is not required. OpenBSD's installer is inside a single 4.5 MiB [1] ramdisk kernel image. Chainload or netboot it, or download the ramdisk to ffs on sd0 and run installboot [2]. Once the ramdisk kernel is loaded you can erase the disk containing it.

1. https://cdn.openbsd.org/pub/OpenBSD/7.5/amd64/bsd.rd

2. installboot also needs /usr/mdec/biosboot and /usr/mdec/boot from base75.tgz.

There are extended stay hotels with stovetops and ovens (and outdoor grills) with low-grade used (ugh!) cookware included. It's usually not much more expensive than regular midtier hotels: possibly cheaper, if you can negotiate a longer term stay.

The last occasions that I stayed at $200/night hotels, someone triggered the building fire alarms at 2:00 and 4:30 AM. Everyone was forced to evacuate until the fire department arrived (the alarm sirens were agonizingly loud). Still, I agree, the Airbnb roulette experience is often worse.

CF says they now no longer allow previously used nameservers to be used again. The only problem with this is if someone swaps CF accounts hundreds/thousands of times and "runs out" of custom names.

It’s not necessary for Cloudflare to remember or to reject all previously assigned name servers: Cloudflare can simply fetch the domain’s cached NS records before DNS enrollment and refuse to assign them again.

I might misunderstand something here, but essentially, the authoritative DNS provider should only need to: (1) check for existing NS records upon registration, (2) never reassign a name server matching #1, and (3) refuse to serve DNS responses from non-assigned name servers.

It seems like the vulnerable providers either respond from or assign prior NS hosts, sometimes with randomized lottery thrown in, which only reduces the takeover probability.

It doesn't. It could hypothetically cost PIR $0. 501(c) organizations are not prohibited from collecting and spending profits, they are prohibited from unreasonably distributing such earnings to private shareholders and individuals (see https://www.irs.gov/pub/irs-tege/eotopicc90.pdf).

In theory, S/MIME and SMIMEA. In reality, normal users demand account data recovery in cases of lost encryption keys and passwords. So key escrow is required, which isn't E2EE. ProtonMail tells forgetful users to shove it, which limits its adoption; meanwhile ProtonMail also supports webmail (another feature requirement) which decrypts messages in the browser, weakening any E2EE claims.

Zero cost TLS certificates might be what Let's Encrypt is known for, but it wasn't the first entity to offer them. LE also disrupted the CA market because of IdenTrust's initial cross-signing, and ACME's development and rollout, under the banner of a well-funded reputable 501(c)(3). Nothing is stopping someone from starting an above-cost 501(c) non-profit registrar, similar to the ISRG or the PIR.

The entire consumer registrar industry is untrustworthy. I can't think of a worse category of online services, ranked by security and sleazebaggery, with the possible exception of the VPN market.

Sadly there's tons of code-based Java build tools, but possibly zero concise (toml/yaml- like) declarative build tools. If you're currently using Groovy or Kotlin scripts for building Java projects however, then Java build scripts are appealing.

If a single remote service can lock you out of your 2FA accounts then you failed with your backup policy. I don't use it, but Apple Passwords makes TOTP secret backups possible, via bulk export and initial key setup.

For athletes and co., sustainability isn't even an idea thought about. Like, I've built quite a few bikes and I've rode with some of the world's best MTBers/cyclists: not once has someone proposed, "How can we make this bike more environmentally friendly?" It's a concept that exists squarely within the minds of some commuters and environmentalist nerds. I'm not making a counterargument: I'm saying, don't expect to win over the enthusiast market if your suggestion is "Buy a heavier (i.e. non-carbon) bike."

In addition, many carbon-intensive bicycles are bought for recreation and are not meant to replace cars at all – they may even involve more car use as cyclists drive out of town for a trip in nature. In all those cases, emissions go up, not down.

I'm impressed: In discussions about cycling, cyclists always get lumped together, and the default assumption is cyclist = commuter, and cycling = less emissions = good. Except that in reality, Dave is transporting 1-2 $10k+ bikes on his 8-15 MPG modified Jeep Wrangler, 3-7 times per week, for drives that he otherwise wouldn't perform.

SMS 2FA is one thing. Bad, but ineffective. SMS-based account recovery is far worse. Every time a major website asks me for a phone number "in case you lose access to your email account" I freak out internally before ensuring I never enter it.

I didn't say I never use it, just that it's not always the core feature. This will depend heavily on your field, but in my past work, the features that were way more essential are: scripting (+ IR lifting), xrefs, CFGs, labels/notes (in a persistent DB).

In my experience decompilers will totally ignore or fail on certain types of malicious code, so they mainly exist to assist disassembly analysis. And for that purpose, they save us an incredible amount of human hours.

Decompilation is often the least important (and least reliable) part of IDA/Ghidra, so comparing the two is unfair. That said, the scene is perpetually starved for good C decompilers, so more attempts are always exciting.

Sure, to be clear, I also think Valve's response was over the top. Conspiring to extradite a foreigner, as a private corporation, is straight out of cyberpunk fiction. Axel's a very lucky person, all things considered. If he had been held liable for Agobot's staggering DDOS/theft/remediation costs many in this community might otherwise think it fair.

Yes. HL2 is how Axel became known to gamers, but it's nearly irrelevant. He also created the most popular open source malware framework (Agobot) in existence at the time. Millions of systems were enlisted in botnets based on variants of his work (which were usually just recompilations with IRC C&C server changes). He didn't typically talk about running a botnet, but many of the other minor project collaborators and IRC regulars did.

I mean, I didn't originally want to call out the insane claim that everyone should try to personally verify all truth propositions. I guess you truly are the ultimate skeptic, or you have infinite time to throw away. Fortunately, for all productive people, our institutions are reliable, more often than not!

>> You trust a system of checks and balances precisely because of this.

> I think trusting in our system of checks and balances No. A thousand times no. No damn way.

Which one is it? I paraphrased you, and you contradicted your own recommendation.

You’re proposing a flawed research methodology which uses an a priori fallacy. If the CIA says A, but an internal memo says B, B is more trustworthy. It’s equally as gullible as believing A, just inverted.

This is a treacherous assumption, especially if it concerns the CIA, which has among its stated missions information and psychological warfare. Propaganda using “accidental” disclosures is normal. By all means, use additional corroboration to update your Bayesian credences, but at that point you’ve advanced beyond the lazy skeptics being discussed.

Sure, but the same people who frequently say this also cite the CIA's declassified MK-ULTRA documents as if they are unimpeachable fact (and not possibly falsehood or strategic disinformation). At the end of the day, the average forum skeptic trusts the CIA more than most normal people do.

I think trusting in our system of checks and balances is a reliable way to avoid the infinite regress of Pyrrhonian skepticism, but that's increasingly seen as a libcuck opinion.

Yes. I've never seen anyone question the accuracy of the Church Committee's disclosures. People who talk about such things are normally eager to say that the US Congress and the CIA can't be trusted. It's just selective skepticism.

/private and /private/tmp are shared between all users (including non-login users). $TMPDIR is safer for sensitive files, but it lacks the macOS sandboxing protection on ~/Downloads.