HN user
https://parkscomputing.com/ https://github.com/paulmooreparks/ https://www.linkedin.com/in/paulmooreparks/
Very cool!
I just did the same thing, but for a byte-code interpreter for a completely novel ISA I made up a while back (with an assist from Claude). I just haven't made the HN post yet, since I'm doing a bit of cleanup.
https://github.com/paulmooreparks/Maize/ https://paulmooreparks.github.io/Maize/
I'm right-handed, and I hold my phone in my left hand and scroll my phone with my left thumb.
Singapore here, checking all the boxes. 200m from a neighborhood park with many trees, and ~700m from a GARGANTUAN park, Jurong Lake Gardens, over 4 km in length with many times that in pathways through gardens and around a lake.
I grew up in Florida, where you might come home and find a cockroach walking out of the bathroom with a towel around its head saying, "We need more toilet paper."
Okay, I kid, but it was almost that bad. We say there are no houses in Florida without cockroaches, just houses where they (mostly) aren't visible.
Now I live in Singapore, famous for being a clean city, and there are rats and cockroaches galore. Tropics, man....
I think you missed the point. I don't abandon security to whatever the agent decides to write.
I don't abandon the code to the agent entirely. I have my own... I wouldn't call it a harness as such, but rather a shared Kanban board, and it'll be the subject of a "Show HN" soon. It suffices to say that I define Kanban cards for each feature or bug, and I have clearly defined review points for each card, post-spec and post-code, where I step in. On top of that, after my review, there is an agentic review, and agents can and do catch things that I missed. The quality of the software has improved quite a bit since I instituted that flow.
I don't know. I find that I'm moving up a level and improving my product-management skills while delegating most of the code to the agents. I'm still very much hands-on with the design and requirements, and I'm asking questions like, "What's our security story for XYZ?", "Are we accounting for colour-blindness?", etc. Not being down in the code allows me to prairie-dog a bit more and see the landscape better.
Whenever I browse Hacker News, I find myself opening the discussion in a new tab, then clicking through in that tab to view the article, then popping back to the discussion. It's all very annoying, when what I really want to do is get a quick overview of the article and see if there is any interesting discussion going on before I dive into either the article or the discussion.
YAVCHN lets me quickly browse an article in scaled-down reader mode in one pane and see the discussion in the pane below. If I find either one compelling, I can click "Open original" to see the original article or "Open on HN" to join the discussion on Hacker News.
- Left pane: The list of articles on Hacker News - Right-top: The linked article, reader-mode extracted - Right-bottom: The HN discussion thread
Two daughters, both born in the 90's. Yes, I encouraged the same kind of freedom, but they weren't quite as adventurous as their dad. I thought they were a bit more adventurous than most of their friends, though.
I'm 55. Growing up in Florida in the 70's and 80's, I was outside for hours at a time. I would wander in the woods, following streams to their source and actually mapping the entire forest (I still have the map). I rode my bicycle all over town, by myself and with my equally adventurous friends, getting into all sorts of dangerous things. I went fishing by myself, literally dodging moccasins and alligators. I'd clean the fish with a very sharp knife when I got back. I still have scars all over my body reminding me of all the trouble I got into.
Damn, I'm glad I got to grow up then.
Kudos to the author for making friends. I have to say, though, that I'm with the Redditors on this. I go to the gym to focus solely on my workout, and that's it. I'll nod and smile to the other regulars, but conversation is simply not on the menu.
I'm thinking about buying a Neo for two reasons: my laptop is only ever used to RDP into my home Windows workstation, which is where I do all my serious work; and because I need to have a Mac to test some software I'm writing (Tela, find it on my GitHub) that has to be multi-platform. The battery life is also a plus for remote work, but that's about it. I don't want to spend four digits where three will do.
That's good advice. I just added that to the new project site, https://telaproject.org/ .
Just spell the month.
Tela has ACLs per machine, but not per service. That's an interesting use case, and I'm shocked that I missed it. I've added it to the pre-1.0 roadmap. Thank you!
Another thing on the release roadmap is a TUN/root story, since there is value in having that layer as well. Tela will always support the user-space approach, however, so that unlike Tailscale it's always accessible.
Thank you! That means more than you know. :) I've thought about an Android client. It would have the same problem that exit-node support would have: Tela is currently engineered as a user-space alternative to Tailscale. However, as I mentioned in another reply here, I've gotten so fond of a lot of the other features of Tela that I might consider adding support for low-level features that require kernel support. It might not be 1.0, but I'm open to suggestions.
If I understand you correctly, you SSH in via cloudflared and then use that tunnel to reach other services through that session. That would work, yes.
Tela takes a little different approach. The agent exposes services directly through the WireGuard tunnel without SSH as an intermediary, so you don't need sshd running on the target. Each machine gets its own loopback address on the client, so there is no port remapping.
The big difference is the relay, though. With cloudflared, Cloudflare terminates TLS at their edge. With Tela, you run the hub yourself and encryption is end-to-end. The hub only ever sees encrypted data (apart from a small header).
It would work, but this laptop is so locked down that I can't even install Docker without begging for permission (it's for a consultant role, not a dev role, so...). That said, my stop-gap solution while I worked on Tela was a cheap Linode VM with tailscale installed, and using SSH port-forwarding to get to RDP. Even at that tiny price, it grated me.
That's true. I'd say, probably performance is the first trade-off, weighing kernel against user-space. For the sorts of scenarios I envision for Tela, it's probably not a huge loss (I won't be running Facebook off of a Tela hub, I don't think). Another is that I have to run and tear down the client myself, though I do have support for running the tela client as a service.
It's funny... I've started using so many of the nifty management features of TelaVisor and Awan Saya that I am now considering adding lower-level support for the features that I explicitly wrote for user-space.
Thank you so much for writing this. I'm also from the desktop era and I can't STAND all the reinvention going on, or the fact that I have to move the mouse all over the screen or randomly stab my phone with my finger to find out what I can interact with.
I'm working on a GUI app and a web app in concert right now. They work in the same niche, but at different levels (one is desktop-level management, the other is enterprise-level management). I stepped back and developed a unified design language (Tela Design Language, or TDL) which has saved my sanity and made the apps actually usable again.
https://parkscomputing.com/content/tdl-reference.html
https://github.com/paulmooreparks/tela/blob/main/TELA-DESIGN...
Thanks! The file sharing is part of the base, FOSS Tela. It uses WebDAV rather than FUSE. The tela client runs a local WebDAV server that proxies file operations through the WireGuard tunnel to the agent on the remote machine. You can mount it as a network drive (Windows maps it as a drive letter, Linux/macOS mount it as a directory) or access it via TelaVisor or the tela CLI. It can be configured as read-only or read-write. Certain file extensions can be banned from upload or rename.
I went with WebDAV because it works on all three platforms without a kernel module or extra driver. For my use case (browsing files, grabbing configs, etc.) it works well enough.
Bi-directional sync is an interesting idea. Right now the sharing is one-directional (the agent exposes a directory, the client mounts it), but I could see adding something like that as a layer on top.
I'm building Tela (https://github.com/paulmooreparks/tela), a self-hosted relay that tunnels TCP services through encrypted WireGuard connections. The key difference from Tailscale and similar tools is that it requires no TUN adapter, no root access, and no admin privileges on either end. It runs entirely in userspace.
My initial motivation was wanting to RDP and SSH into my home workstation from a locked-down corporate laptop when I travel. I couldn't install Tailscale on the laptop, and I didn't want to pay for a cloud VM just to do SSH port forwarding. Now I use it to tie together half a dozen machines, both locally and on Hetzner & Linode. I can SSH and RDP into remote machines, host a git repo on one machine and access it from the others, and (optionally) share files across all of them on a local mount.
You run a hub (telahubd), register machines with a lightweight agent (telad), and connect from anywhere with the client (tela). All three are single Go binaries with no external dependencies. The hub never sees your traffic. It just relays opaque WireGuard ciphertext.
All binaries run on Windows, Linux, and macOS. There is also a desktop GUI app, TelaVisor, that wraps the client and enables remote management of hubs and agents.
It's Apache 2.0-license and pre-1.0 release, but I'm polishing it for a stable 1.0 release in the next month or so.
I'm also working on an enterprise-grade management portal that works with Tela, https://awansaya.net/
No, it doesn't create an L3 like Tailscale. A client (a machine running the tela CLI) connects to an agent (a machine running telad) via a hub (a machine running telahubd), but once they connect they negotiate a P2P route if they can. That's all managed by Wireguard an gVisor. The remote service is forwarded to a port on localhost, so SSH to a VM somewhere else would just be ssh to, say, localhost:10022. I'm investigating a local DNS so that users can instead type `ssh paul@dev-vm` instead of `ssh -p 10022 paul@localhost`.
Thanks! Yes, Tela already does UDP hole-punching. I made Tela because I wasn't allowed to install Tailscale on my new corporate laptop, and no other available solution seemed to tick the right boxes. It started as a simple way to RDP to my home workstation, but then I realised that if I could do that, I could finally pull my ad-hoc home cloud into one tool. The hub model is very much by design, for organisational purposes. The hole-punching feature gives me the P2P speed (and even STUN, if available). An upcoming version will allow hub-to-hub topologies.
It should have occurred to me that tela is also Spanish, since about every third word I hear in a Tagalog sentence seems to be of Spanish origin.
I'm building my own cloud (I actually typed claude instead of cloud there... wow). There's no IaaS or PaaS; it's much simpler. I wanted my own way of connecting to machines and the TCP services on those machines without having to install Tailscale (not allowed on a locked-down corporate PC) or pay for Azure or AWS or GCP or even Hetzner or Linode. I've got 10gbps fibre and a huge workstation at home, and I've got lots of laptops and VMs and other outboard stuff that I want to work in concert with that workstation, so I started building something I call Tela (Filipino for fabric; I was sitting in Ninoy Aquino International Airport waiting for a flight when I had the idea, and it's implemented as a network fabric).
Nice system. I think I'd cut out a bit of adhesive whiteboard material and draw dots on that, but that has its own downsides.
Little systems like this are so useful. For example, I have a similar system for clothes hanging in my closet. Shirts hang on the left side of the bar, trousers on the right. Empty hangers go into the middle. Clean clothes are always placed into the middle on the appropriate side. Whenever I pull something out to wear, I choose from the ends, not the middle.
This does two things: First, I'm cycling my clothes a little more fairly instead of wearing the same stuff over and over (the DS&A nerds among you would call this an LRU cache, I guess). Second, clothes that I don't like so much or just don't use, for whatever reason, get pushed to the ends, and every year I pull out the stuff that's been stuck at the ends for a while and donate it to charity, without a moment's thought.
Interesting moral discussion: An estimated 8000 fewer births in 2017 attributed to a law that saved an estimated 57 lives in the same year.
Input:
Buffalo buffalo buffalo buffalo buffalo buffalo buffalo buffalo.
Output:
Unlocking the power of synergy: Buffalo buffalo buffalo buffalo buffalo buffalo buffalo buffalo.
It’s all about leveraging local ecosystems to drive impactful results. When we talk about buffalo from Buffalo who intimidate other buffalo from Buffalo, we’re really talking about the competitive landscape of modern leadership.
Are you intimidating your peers, or are you empowering them to scale? Let’s disrupt the status quo together. #Leadership #BuffaloMindset #Synergy #Networking #GrowthHacking
Not too shabby. Weird that it just repeated it in the first paragraph but then understood it in the second one.
Exactly. Even if I hammer the erstwhile reviewer with Teams/Slack messages to get it moved to the top of the queue and finished before the 5 hours are up, then all the other reviews get pushed down. It averages out, and the review market corrects.
Note to the author of TFA: The moment I get a sign-up modal on any site, I close the tab and move on.