oarmstrong

I share your disdain for buzzwords but SRE is definitely a different role.

Ah got it, thanks. I thought you were testing the image somehow, a bit like inspec.

Still cool though, nice.

Could you tell me more about the playwright tests? From what I can see it's a web testing framework, I don't see how that fits in here.

My CI server uses Firecracker VM's to isolate OCI containers

Is this something you built yourself? I've been looking for a CI tool that uses Firecracker but never found anything, I started building something myself but it never really got finished. Would love to drop that project and use something off the shelf.

Consul is built upon the Serf library. https://www.serf.io/intro/vs-consul.html

Yes, the article did.

Framework has open sourced the EC firmware, not the boot firmware. The UEFI implementation is still closed source proprietary InsydeH2O software.

Hashicorp's Vault works quite nicely. Teleport is another tool I believe handles this but haven't used it personally.

Right, running ECS on EC2, not Fargate on EC2. When ECS launched it only had the EC2 launch type (where as you said you must manage your machines). Fargate then came along for both ECS and EKS where Amazon managed the machines for you.

Fargate on EC2? Sorry you’ve lost me, I understood Fargate to be a layer of AWS managed compute for ECS or EKS deliberately instead of EC2.

I would imagine so the default behaviour could be identical across platforms.

I agree that it’s boring and works well. It’s also what I’m most worried about finding a reasonable alternative, we can’t just not update Vault.

Sadly Secrets Manager doesn’t hit all the features I need. Really hoping for an OpenTF-style fork of Vault.

What are you looking at for a Vault replacement?

Obviously it’s a different OS and possibly isn’t relevant to you but I’ve found solace in OpenBSD (and other BSDs) in the search of “simplicity” of “the old days”.

I’d like to know more about AMD specifically too. I’m well aware that PSP is their equivalent but there seems to be so little information out there about it. Is it really an equivalent? Is it as bad as ME? Can it be disabled? Does it have the same level of access as ME? Have their been any exploits of it yet?

The wikipedia page is rather bare. There’s a couple of papers linked to but frankly they go over my head. Is there any respectable analysis out there?

That’s one I heard about a while back but haven’t given it a shot yet. I will now, thanks.

Couldn’t recommend it more. Simply beautiful game. Definitely agree with going in completely blind, try not to even read the Steam description, discovering the core mechanics was very much part of the experience for me. I was left very empty when I finished it, I wanted more and more; like finishing a fantastic book. Easily one of my favourite games of all time.

I didn’t enjoy the DLC as much as the base game, it felt rather disconnected. Which was disappointing given how connected the rest of the game is. Still a nice story, just not quite as good for me.

Are there any other similar games I may also enjoy? I’ve also played Journey and found that to be similarly touching. Stray was also very enjoyable for me.

Bingo!

https://en.m.wikipedia.org/wiki/IPv4#Addressing

IPv4 addresses may be represented in any notation expressing a 32-bit integer value.

I remember reading a man page that explained this really succinctly but I cannot remember which one it was. A tool like ping I believe.

It is possible to buy an anonymous eSIM, the only provider I have come across won’t allow outbound SMS or calls though. Inbound SMS and calls as well as data are fully functioning. (Therefore can be used for messaging services that require a verified phone number).

I know that’s not exactly what everyone would want, but for some use cases that may suffice.

Are you perhaps conflating Discord and Discourse? Discourse is certainly a forum in my eyes.

I tend to use a similar approach, though with Terraform var files instead of env vars. It was also possible to have this work with TF Cloud (and presumably Enterprise?) with a single workspace env var specifying the var file. It might have been improved recently to be a first class feature.

I found this to be my favourite workflow for managing workspace variables in a way that was also flexible to being run outside of TFC/TFE for when that makes sense.

You won't be able to build and deploy iOS apps without running OS X - so that's not an option from Linux/Windows unfortunately.

You can use something like Appcelerator Titanium[1] to use HTML/JS and build native apps from that. So you will be able to use what you build to deploy to iOS should you purchase a Mac in the future.

[1] http://www.appcelerator.com/platform/titanium-platform/

In case anyone is having difficulty with the font used on the page, the escape sequence is: newline followed by tilde (~) and then period (.).

Thanks for the tip! I don't tend to nest sessions more than two deep but this could be useful for those who have deep nestings.

I've never come across an openpgp smartcard, any particular one you recommend? I might look into this, seems like a very good idea.

Just worked that out and then saw your reply. Shouldn't have doubted myself. You're clearly more knowledgable about this than I!

It uses libpam-google-authenticator, looking at the source for google-authenticator.c[0] (line 156-7) it appears to use the Google Chart Infographic[1] API (which as a side note has been officially deprecated).

Can't quite work out how it is displaying it, I'm not competent enough with plain old C, but I'm sure someone can follow the code and chime in.

EDIT: Looks like it uses libqrencode and if that's not found it just uses Unicode block elements for actually displaying it from Google's API.

[0] http://google-authenticator.googlecode.com/git/libpam/google...

[1] https://developers.google.com/chart/infographics/

That's what I meant, thanks. Don't know how I had such a hard time trying to explain that!

By design TFA uses something one possesses that nobody else does, isn't this identical in principal as the private key?

I understand why and how this adds the extra security for the 'traditional' password authentication due to all the methods of compromising a password: brute force, guessing, exploits etc.; so for TFA to add an extra layer surely the private key would have to be exploitable in some form?

Maybe I phrased myself incorrectly in that I still see how it adds an extra layer of security but I fail to see why one would do this on top of a key based auth method.

I know the original article didn't mention using it on top of key auth but I wanted some insight as to whether or not it would be worth doing. As do many, I use TFA for any online service I can so I do appreciate its point in that sense.

EDIT: I never really considered the fact that the private key could be stolen via malicious software. Taking that into account I see the value in TFA for SSH.