• 1 Post
  • 439 Comments
Joined 2 years ago
cake
Cake day: June 7th, 2023

help-circle
  • My list of items I look for:

    • A docker image is available. Not some sort of make or build script which make gods know what changes to my system, even if the end result is a docker image. Just have a docker image out on Dockerhub or a Dockerfile as part of the project. A docker-compose.yaml file is a nice bonus.
    • Two factor auth. I understand this is hard, but if you are actually building something you want people to seriously use, it needs to be seriously secured. Bonus points for working with my YubiKey.
    • Good authentication logging. I may be an outlier on this one, but I actually look at the audit logs for my services. Having a log of authentication activity (successes and failures) is important to me. I use both fail2ban to block off IPs which get up to any fuckery and I manually blackhole entire ASNs when it seems they are sourcing a lot of attacks. Give me timestamps (in ISO8601 format, all other formats are wrong), IP address, username, success or failure (as a independent field, not buried in a message or other string) and any client information you can (e.g. User-Agent strings).
    • Good error logging. Look, I kinda suck, I’m gonna break stuff. When I do, it’s nice to have solid logging giving me an idea of what I broke and to provide a standardized error code to search on. It also means that, when I give up and post it as an issue to your github page, I can provide you with some useful context.

    As for that hackernews response, I’d categorically disagree with most of it.

    An app, self-contained, (essentially) a single file with minimal dependencies.

    Ya…no. Complex stuff is complex. And a lot of good stuff is complex. My main, self-hosted app is NextCloud. Trying to run that as some monolithic app would be brain-dead stupid. Just for the sake of maintainability, it is going to need to be a fairly sprawling list of files and folders. And it’s going to be dependent on some sort of web server software. And that is a very good place to NOT roll your own. Good web server software is hard, secure web server software is damn near impossible. Let the large projects (Apache/Nginx) handle that bit for you.

    Not something so complex that it requires docker.

    “Requires docker” may be a bit much. But, there is a reason people like to containerize stuff, it avoids a lot of problems. And supporting whatever random setup people have just sucks. I can understand just putting a project out as a container and telling people to fuck off with their magical snowflake setup. There is a reason flatpak is gaining popularity.
    Honestly, I see docker as a way to reduce complexity in my setup. I don’t have to worry about dependencies or having the right version of some library on my OS. I don’t worry about different apps needing different versions of the same library. I don’t need to maintain different virtual python environments for different apps. The containers “just work”. Hell, I regularly dockerize dedicated game servers just for my wife and I to play on.

    Not something that requires you to install a separate database.

    Oh goodie, let’s all create our own database formats and re-learn the lessons of the '90s about how hard databases actually are! No really, fuck off with that noise. If your app needs a small database backend, maybe try SQLite. But, some things just need a real database. And as with web servers, rolling your own is usually a bad plan.

    Not something that depends on redis and other external services.

    Again, sometimes you just need to have certain functionality and there is no point re-inventing the wheel every time. Breaking those discrete things out into other microservices can make sense. Sure, this means you are now beholden to everything that other service does; but, your app will never be an island. You are always going to be using libraries that other people wrote. Just try to avoid too much sprawl. Every dependency you spin up means your users are now maintaining an extra application. And you should probably build a bit of checking into your app to ensure that those dependencies are in sync. It really sucks to upgrade a service and have it fail, only to discover that one of it’s dependencies needed to be upgraded manually first, and now the whole thing is corrupt and needs to be restored from backup. Yes, users should read the release notes, they never do.
    The corollary here is to be careful about setting your users up for a supply chain attack. Every dependency or external library you add is one more place for your application to be attacked. And just because the actual vulnerability is in SomeCoolLib.js, it’s still your app getting hacked. You chose that library, you’re now beholden to everything it gets wrong.

    At the end of it all, I’d say the best app to write is the one you are interested in writing. The internet is littered with lots of good intentions and interesting starts. There is a lot less software which is actually feature complete and useful. If you lose interest, because you are so busy trying to please a whole bunch of idiots on the other side of the internet, you will never actually release anything. You do you, and fuck all the haters. If what you put out is interesting and useful, us users will show up and figure out how to use it. We’ll also bitch and moan, no matter how great your app is. It’s what users do. Do listen, feedback is useful. But, also remember that opinions are like assholes: everyone has one, and most of them stink.


  • I think it depends on what you want to print. Personally, most of my prints fit within a much smaller footprint. So, I don’t usually need my first layer to be perfect across the full bed. However, when trying to print something larger, I can absolutely tell how terrible my first layer is. It sucks to end up reprinting the first layer half a dozen times, because one small area keeps failing to adhere.

    A large part of my issue is the printer I have just isn’t all that good. And, when I get less lazy, I’m going to just build a Voron. At that point, I’ll probably be one of those folks tweaking it until I get a perfect first layer. Because I want to be able to start a print and not spend the next hour fighting first layer problems.




  • A brick and mortar store has a lot of overhead. And, even with merch sales, GameStop doesn’t have enough to offer to differentiate itself from online stores for that same merch. Why would I take the time to walk/drive over to the GameStop to buy some cheap crap from China, when I can go online and buy that same cheap crap from China for less online. Especially, when I can often get it direct from China (via AliExpress or the like) for even less? Without the sales of physical media and the used game market, there just isn’t a viable business case for GameStop anymore. Sure, I found the whole GameStop stock meme funny too. And it sucked that some big fund tried to short them into the dirt. But, looked at from a dispassionate perspective, the current business model is doomed.


  • It’s not nice as something to target, but it makes sense. Employment is about more than just straight money. When evaluating an employer, I consider everything from the top line salary, to benefits, work culture, work life balance and work environment. The non-tangible factors can mean that I would be willing to take a lower salary. That is why companies will do things like decked out rec rooms or the like. And ya, I might consider a lower salary to be part of something I love or believe in. E.g. If NASA were looking for remote cybersecurity workers, I might consider a lower salary that I would get elsewhere, just to get to be part of NASA.

    Employment is a negotiation between you and your employer. And while I do think technical folks could really use a trade union (something like the IBEW for electricians), for now you have to represent yourself and make sure you get what you are worth. And this might mean not working on the thing you are really passionate about. Especially if the people in charge of it are a bag of dicks.






  • I was lucky that, despite being somewhat religious, my parents were fine with me being an atheist. We would even debate the merits of religion and they did not have any issues with my questioning of their beliefs. Both were Lutheran and they had raised me in that tradition. I went to Sunday school, attended the Lutheran Catechism and reached the point of Confirmation. And that was right about the time I realized that the whole thing seemed to be based on a bunch of old stories with no more evidence than elves or faeries. And that was always the crux of my issue with their religion, and one they could never argue past.

    When it came to my kids, they have been raised with my complete lack of belief and my wife being agnostic. We spend our Sunday mornings sleeping in and not going to any sort of church/temple/forest altar. Though, that last might happen, if it’s ruins at the end of a nice hike. My parents never expressed any disapproval and the lack of religion was never an issue. Technically, my mother is still kicking about and could suddenly go off the deep end, though I strongly doubt that’s in the cards.

    At the same time, my wife and I had discussed religion before we had kids and what we might do in the event it became an issue. The simple answer was, “fuck 'em”. I love my parents, but my kids come first. If my parents had decided to get stupid over us not indoctrinating our kids in their fairy tales, then I would have just removed them from my life a few years before death did it anyway. Sure, it would have meant the kids never knowing their grandparents. But, there are lots of assholes in this world, I don’t see the need to personally inflict them all upon my children.

    The best thing you can do is talk to your partner and have a plan. I would say that, if you expect it to be a point of contention with your parents, you might want to talk with them about your views on religion before it gets to that point. It doesn’t need to be anything confrontational, just be up front and say, “I don’t believe what you do”. You don’t need to go on a Dawkins style, “your religion sucks and you are morons for believing it.” Just make it clear that you don’t believe. It’s still entirely possible to have a warm, loving relationship with folks who don’t believe as you do. It just requires that each side treats the other with basic human decency and respect.


  • I generally use the OS which fits what I am trying to do. For my desktop PC, I run Arch Linux as it lets me game, run VMs and have a high level of control over what the system is doing. The VMs are mostly Windows for testing stuff and one running Ubuntu as a host for PolarProxy. My server runs Ubuntu, though really just as a platform to host docker containers. That was a decision I made years ago when I knew a lot less about Linux and was looking for something which was more turnkey. My work laptop is Windows, because my work is mostly a Microsoft shop. But, I have WSL running both Ubuntu (for the SANS Sift framework) and Kali.

    An Operating System is a tool. Don’t get wedded to any one OS.



  • Popular beliefs influences people’s beliefs, which reinforces popular beliefs. Step back even farther from the question for a moment and ask, “why do you think of ghosts as dead human spirits at all?” That a “ghost” is some sort of dead human spirit is a concept that has been built into Western society for a long time. It is something we just accept in story telling and mythological belief systems because it’s been in them so long and is told to us via authoritative figures in our lives from an early age. To tell a story where a ghost is anything other than a dead human spirit or the echo of a dead human, makes people call bullshit on the story, because the story has broken a long standing societal expectation. Sure, some stories can get away with it, and more so in the modern age where we are starting to appreciate stories which subvert long standing expectations. But, we still tend to fall back on old tropes and devices which we can expect readers to understand, without having to spend too much time on building a world. It’s far easier to save the term “ghost” for something much like a dead human spirit and just create a new term when trying to describe something else.





  • Ya, I know that’s exactly what’s going to happen. But, you have to start somewhere. Just getting management used to the idea that data must be encrypted is a start. That will then push the software vendors in the space to make fundamental changes, which will hopefully improve things a bit.

    I actually have a pretty good example from my time in the US FedGov space. We were required (by our checkbox security) to enforce FIPS-140 compliance on all our systems. When working to setup a server for a new product, it just would not run with FIPS-140 in enforcement mode; so, I started digging into the product and found that they were still using the MD5 algorithm in their user password hashing process. Given how much the vendor really wanted our business (we were their “foot in the door” for more FedGov money), I sent an email to our customer service rep essentially saying “ya, MD5 as part of the password hashing is a deal breaker”. A couple weeks later a new version of the product dropped and surprise, surprise, MD5 was no longer part of the password hashing process.

    The reliance on checkboxes sucks; but, they can be a useful club to make improvements. A shift to real security takes time and a lot of effort. But, that journey starts with a first step.