ivlad

Or, you use `xargs -0` for null termination instead of white space termination. `find` conveniently supports `-print0` that will use null character as separator.

Was exactly my thought: why not to use null termination?

Looks like a case where reading man page would have spared writing another copycat utility.

TP-Link is absolute crap of network hardware. Not to mention “leftover debug code”: https://nvd.nist.gov/vuln/detail/CVE-2024-21827

Genuine question, if you use bastion hosts, why do you need Tailscale? Why not to expose tcp/22 to the internet and allow public key authentication only (or, certificate based one, if you prefer fancy)? OpenSSH security track record seems to be better than that of Tailscale.

Rolex and Casio deal with simply when IERS introduces one.

Beats is a new time measurement system, not just a new clock. So if the world (IERS) would stops it, they would have to have new rules for dealing with leap “micro-days” or “mili-beats”.

And second is the fundamental SI constant, quite a bit of stuff is derived from it.

Enterprise PKI is not hard and has many uses besides issuing certificates to web servers. Any company of 1000+ users or endpoints should just set one up.

I did it multiple times, most recently using YubiHSM as root key store for offline enterprise root CA.

Or, just use IPv6 and host Internet services in a routable address. Then, use ACLs at web server / proxy / L7 lb level to allow acme-challenge unauthenticated but everything else authenticated.

Lets encrypt supports IPv6 for validation.

It looks like a poorly thought-out marketing project. For example, how to deal with the Earth rotation irregularity and leap seconds? One beat is way too long to correct with, so the correction has to be in centibeats, fractions of beat, inconvenient. Why would this in CET and not in UTC? Aligning start of the day with the existing customs seems beneficial.

But the idea of the universal decimal time is a nice one. I wish we had something like that.

Native Apple Maps allow downloading map regions for offline use.

Dostoyevsky was originally published in magazines chapter by chapter, so he would end the December’s on a cliffhanger so that the readers re-subscribed

Really. Back in the days, the majority of “researchers” sent scan results. The term “beg bounty” didn’t come about for nothing.

It turned out, they were talking about it since quite some time: https://conference.apnic.net/60/assets/presentation-files/39...

Current customer penetration is at 63% with 86% of government agencies have migrated their online portals to IPv6.

Would you give your personal phone number to random strangers on the internet, or even publish it on a website? Probably not, due to the possibility of harassment, right? IP addresses aren't any different

1. The claim that IP addresses aren’t different from the phone numbers requires proof

2. Until very recently, just before the Covid pandemic people regularly exchanged physical business cards with their mobile phone numbers. So, yes, people do that.

Realistically nobody outside some devoted HN readers are going to self host their own content.

P2P is not “self hosting”.

It’s video/audio conferencing working with less latency. It’s the ability to send a file directly and not via some file sharing site. It’s multiplayer gaming simplified. It’s faster software updates via BitTorrent.

NDP is not simpler than ARP. For one, NDP relies on link-local addresses to work which in turn relies on MAC multicast where ARP relies on MAC broadcast only.

Because you need to pre-allocate space and indies for it in case things go wrong and the disk is almost full

Not really.

Nothing prevents host from configuring a static link-local address, like fe80::1234. Not only that, some networks choose to have some standard link local address as a default gateway. For example, a router or a L3 switch can have fe80::1 on its downstream interfaces. This way, all hosts on all networks have fe80::1 as the default gateway and the router will have fe80::1 address on multiple interfaces.

Furthermore, you can (and some say, should) use link local addresses on transit links between your network devices, eg, between layers of switches in a hyperscale-sized data center network. Typically, the addresses will be deterministically configured, for example, consider

-(e1.0)[switch1](e1.1)—--(e2.48)[switch2](e2.25)-(eth0)[server1]

We have server1 connected to top-of-rack switch2 connected to aggregator switch1. Link between switch1 and switch2 is point-to-point transit. You can use exclusively link local addresses there. There are a few approaches:

- e2.48 gets fe80::2, e1.1 gets fe80::1 - all upstream ports are always fe80::2 in all network, all downstream ports are always fe80::1. A good thing is that link configuration is the same on all switches regardless of the Clos layer.

- switch1 serial number is 1001, switch2 serial number is 2002. Then, e2.48 gets fe80::2002, e1.1 gets fe80::1001. This way, all interfaces on a switch N have address fe80::N

You then can set up BGP session between the link local addresses and it either will always be either fe80::1 <-> fe80::2 or fe80::N <-> fe80::M. Switches also have a loopback address for ping, and other ICMP traffic. Either has advantages and disadvantages.

This is discussed in more details in RFC 6164, and a more high level overview is provided in RFC 7404.

I am sorry, I should’ve read it twice before posting. I meant, QC to attack longer keys should be bigger proportionally. Number of operations is logarithmic. Silly me.

I am not NSA, but I think their idea is something along the “once Shor’s algorithm is practical for key sizes of hundreds of bits, it’s only a matter of a few years of engineering effort to make it feasible for thousands bits long keys”. In other words, there is no sufficient safety margin for larger keys.

… because?

Edit: yes, I read it and it is.

He is not wrong on the main claim, which is “All ECC (X25519-P521) will be broken by private sector quantum chips before RSA-2048 due to the physical limitations of stabilizing qubits.”

Shor’s algorithm is polynomial, however the number of qubits required is in order of O(log(n)^2), where n is the length of the key. Because ECC keys are much shorter (e.g., 256 to 521 bits) than RSA (2048 to 4096 bits), a smaller quantum computer would be needed to attack ECC.

IPv6 + transport mode IPsec + opportunistic encryption with TOFU or other topologies of trust (including WoT, DNSSEC and PKI). All that is standard, most of it is available and only requires configuration (and, ideally, being turned on by default).

There is very little use for companies like Tailscale in this setup, it’s scalable and works.

I acquainted with a guy at a conference in US and he was genuinely surprised I had no idea, how long US mile is. I explained him, we use metric system and his response was “but don’t you learn *the standard* system in ache school?” I did not know, how to respond.

You will probably spent some time "teaching" them first

SELinux works well out of the box in RHEL and its derivatives since many years. You comment shows, you did not actually try it.

fight with them every time you install something or make other changes in your system

If you install anything that does not take permissions into account, it will break. Try running nginx with nginx.conf permissions set to 000, you will not be surprised, it does not work.

disallow users to choose a password they used previously (never understood that one)

That’s because you never responded to an incident when user changed their compromised password because they were forced to only to change it back next day because “it’s too hard to remember a new one”.

Dear user with password “password11111111111” logging in from a random computer with two password stealers active, from a foreign country, and not willing to use MFA, incident response team will thank you and prepare a warm welcome when you are back to office.

Honestly, this comment shows, that user education does not work.

This is a lie created by webmail providers. There is nothing difficult in self hosting email, abd ensuring email delivery.

You choose to have Google spying devices at home. You choose to have Gmail. You may have no choice for Internet search for quite some time, but you certainly choose your browser.

Start there.

You can ask and they will ask for a Netflix size commitment in turn. Volume prices (they are essentially volume discounts) are often public.