raphinou

Thanks for the appreciation and the tip! I'll keep an eye on edky!

Asfaload is easy to selfhost, if it is of any interest to you.

Interesting. I'm using ed25519 keys in my open source project [1] to sign GitHub releases (amongst other things) and the encoding question appeared during the development. I settled on supporting reading ssh keys, but saving keys in a specific format. I'll need to have a look to possible revisit my choices as it is developed in rust too.

1: https://www.asfaload.com

Sources at https://github.com/asfaload/asfaload

I think websharper's Var are similar to this, and it is really great to develop dynamic web interfaces (in fsharp).

Is the familiar syntax so important? I learnt f# being used to algol syntax, and the syntax was not a hurdle.

Wondering if with such shady tactics, they respect the fact that I didn't consent and closed the (private) tab I opened the page in.

Did you use some specific tools to collect the data to be displayed on that map?

I would love to take an Interrail, eg to visit France, but it's x days in one month (8 days is 292€ per person) and doesn't match my travel habits. I would prefer to make short travels everyday rather than long travels 8 days of the month.

Edit: global passes let you travel everyday of your pass, with passes of up to 3 months: https://www.interrail.com/en/interrail-passes/global-pass

Can this be useful for someone with no prior knowledge of lean? I'd like to verify a software I'm working on, but I have no experience in formal verification. Can I get useful result with the spec, the code and some (limited) learning time on my side?

I'd expect that if females start to breed more than once it would represent a problem. It's surprising it hasn't happened yet (for the ignorant of the field that I am at least)

Thanks for reporting it! I'll have a look

I am currently recording tutorial videos for an open source project. It's produced fully with Foss software (on Linux, obs, kdenlive) and about an open source project, so I wanted to host it with peertube (though YouTube might be used later on for its network effect, it was easier to publish with peertube as yt required an video of me and my ID). It's going fine until now. I don't host peertube myself though, I use an existing instance, and embed the videos in the website.

It was a really good experience, so I'll continue that way.

If you want to check out the videos: https://www.asfaload.com/videos/

In case anyone is interested, I'm also using bash scripts to run my agents in containers. It's simple, but has only bash and docker as dependency: https://github.com/asfaload/agents_container

It probably started as a helper script and grew from there. The script seems quite focused and doesn't grow, so a rewrite might not be warranted.

It also has no other dependency, which is also good. I have written helper script to run coding agents in a container. And you guessed it, it's in bash. For the reasons I just wrote down. Should it have to grow I would rewrite it, but not currently.

At a time I was very interested in haxe, but their focus on games made it (perceived as) lacking in the area I wanted to use it (cross platform client-server apps). Recently rust seems to have taken this role for me.

Damn! Would you have the opportunity to share experiences? My emails is in my profile, it would be great to hear from you. (It is an open source project, which makes it even harder to sell probably, so every hint might help!)

Good timing for me too. I'm currently looking for a first customer with whom I'd possibly shape the product a bit. The development phase was fun, now comes the hard part. Additionally I'm working on a security related product (digital artifact authenticity validation) and I feel like security is a hard sell especially in my network as they don't seem to correspond to the product's target (or I'm a poor promoter of the solution....). .

Putting finishing touches on an open source multi sig solution to authenticate digital artifact, aiming to increase security of the software supply chain. It's open source, completely self hostable, incl internally, support air gapped signers, fully auditable (data store is a puglic git repo). It's an alternative to sigstore, making different decision.

Website: https://www.asfaload.com/

Code: https://github.com/asfaload/asfaload

The open source project I'm working on aims to authenticate artifact downloads (project name is asfaload, in short it is a sigstore alternative). My understanding is that in a post-quantum world, the private key can be derived from an ed25519 pub key. That means that an attacker can generate new signatures. But I don't think an attacker would be able to generate a malicious artifact that matches an existing signature. It would seem that once we are nearing PQC, Asfaload would need to support PQC signatures, and its uses would need to migrate to new keys, but that existing signatures would still be safe to use for validation. Is that right?

I've been working on a new project using ed25519 signatures and discovered they are not quantum resistant.... I went with ed25519 due to possibility of using openssh keys. Any opinion on this choice at the light of this article and other quantum computing news?

I agree! It's amazing to require the visitor to edit the url to go from blog to main site. For my projects I pay attention to avoid this as I find it so annoying. I want visitor that are interested to have easy access to the website!

When will we finally sign artifacts?

I'm not only complaining, I also work on a solution (asfaload) that I want easy to use. As it is multisig, such platform breaches become impossible. Below is the doc of the CLI, i'm looking for testers and challengers of the solution!

https://asfaload.com/doc/

I've had good experience with authelia. Simple and light to self host.

I'm very happy using docker swarm on a single host with traefik as reverse proxy using the setup described here: https://dockerswarm.rocks/

Super easy deployment of additional apps, defined completely in one file (incl setup on host, backups, reverse proxy config, etc).

Never found a reason to migrate away. Swarm was already considered dead when I started using it in 2022[1], but the investment was so low and benefits so big, that it was the right choice for me. I think a lot of people are replicating swarm features with compose, losing a lot of time. But hey, to each their own choice!

1: https://www.yvesdennels.com/posts/docker-swarm-in-2022/

My understanding was they would process a refund, but no further compensation? Otherwise why would they look for an account to process the refund?

English is not my first language, so I might have misunderstood....

Thanks for the positive feedback! It combines administration features and end user interace. The definition of data structure is not very intuitive, and that would be the first and most important thing to fix. I think a lot of people get lost at the definition of their first table....

Backed by postgres, using the crosstab function. Developed and deployed on Linux Ui through the browser, built with https://websharper.com/

Thanks for the star!

I have such a project I just can't shut down: https://myowndb.com/ I started it 20 years ago, with ruby on rails. I neglected it but then decided to rewrite it in F# and publish it as open source (https://gitlab.com/myowndb/myowndb). There are very few users, some from many years ago, all non paying. None gave any feedback I asked during the rewrite. I should have shut it down years ago, but I just can't take the step. I'm focused on another project now, but who knows, maybe I'll get back to it....

What solution do you use for declarative deployments? Last time I looked there was no default option?

From my understanding the checkmarx attack could have been prevented by the asfaload project I'm working on. See https://github.com/asfaload/asfaload

It is:

- open source

- accountless(keys are identity)

- using a public git backend making it easily auditable

- easy to self host, meaning you can easily deploy it internally

- multisig, meaning event if GitHub account is breached, malevolent artifacts can be detected

- validating a download transparantly to the user, which only requires the download url, contrary to sigstore

Am I missing something? I'm genuinely surprised it was not deployed from the start on a dedicated server. Don't you make a cost analysis before deploy? And if the cost analysis was ok at initial deploy, why wait to have such a difference in cost before migrating? How much money goes wasted in such situations?