Ayesh

Great read. I miss these kinds of articles, compared to the "use this Docker image that has everything pre-configured" articles so common today.

There's a much higher sense of achievement when putting things together with deliberate configuration and sorting out how to glue things together.

I've been using Firefox's built-in password manager before moving to Bitwarden, and I don't think Firefox's isn't all that bad.

All passwords are E2EE, and the sync server is open source and you can theoretically self host it.

I recently read about how Bitwarden adds Passkeys to Firefox, and was left sour there is no universal API for it. Bitwarden just overrides it as JS level, and hands it over to the browser if there are no passkeys selected/available.

I imagine Safari + keychain is coupled in a more secure and well-defined way.

I'm not using macOS or this browser, but my guess, seeing how the website mentions it's native app, it probably has to do with ibtegrations with certain features available in each macOS version. Live text, sharing options, etc.

In fairness to Mozilla, Thunderbird, Bugzilla, and a few projects like DMOZ were fairly well received projects. Even recent ones like Firefox Send and their email forwarding service are quite nice additions. On the software side, their investments in in-browser translations are money well spent IMO.

It's the stuff like Firefox OS and Pocket gave the bad rep to Mozilla. I don't know what they were smoking about Pocket, but I can see their thought process in making Firefox OS. Chrome OS eventually did become a mainstream OS, it could have been Firefox OS too, if it has the right people and money.

> going for groceries...

I really this analogy. It feels weird especially when Google and Brave both have their own browser and ad programs, so it's in Kagi's favor to stay as far as possible from inventing their own browser.

I didn't knew Gandi was taken over (I was never a customer).

I recently started to use NS1, which was taken over by IBM. It's nice and fast, comes with a great API, which even their web control panel also uses. The only negative side is that it's now owned by IBM.

I use some RHEL-alike products anyway, so I didn't mind NS1 now being IBM. NS1 doesn't mention any pricing, and I'm using their free developer accounts for my personal sites. I think it will get very expensive really quick once you become enterprise customers.

I run a small website that tracks releases of a software, it probes releases every few hours, with each run consuming a several hundreds of API requests. GitHub API token limits are pretty generous. There is no paid offerings to increase the limits, so I suppose if you ask GitHub nicely, they will increase the limits given a reasonable justification.

Idea for a password manager: alternative DoH server (with own root, it solves DNSSEC issues) with proper authentication that returns the username and password for each site as TXT records.

So you can `dig` to retrieve passwords:

` dig example.com @my.crazy.password.manager.tld `

` example.com. TXT "username=myuser;password=hunter2"

You can now use tools like rsync, ssh, irc, browsers,next to piggy back in DNS to resolve passwords and private keys, even TOTPs

The most fun I had with TXT records was that putting an an XSS payload and chuckle at those "online DNS lookup" tools popping up my alert() calls.

On Android 12+ (if my memory serves well), you can use DNS over TLS without having to install any additional software. It seems to cover all of the connections, but I don't think DoT is used when your phone connects to your network for VoWifi and eSIM provisioning connections (I didn't see them in my NextDNS logs)

Spotify is also the only app apart from YouTube Music that works in Google Home devices (at least in my region).

In fairness to PHP, almost every PHP 7+ version from the 5-6 years had things deprecated especially to "cure" these things.

Me too.

I have Firefox installed on my phone (Android) as well, but I found Brave to be faster with its "baked in" ad blocker compared to Firefox Android + uBO.

Brave on Android is still an annoying software, with VPN, Rewards, and News icons in the burger menu that you can't disable. You can turn off the services, but the icons do not go away.

My naive thought is that they could have an E2EE search index for each mailbox? I wouldn't even mind if the index storage counts against the quota.

I participate in a couple programs, and when I report something, they have a team at the bug reporting service take a look first before escalating them to the actual security contact. Only issues that are in-scoope and severe enough get escalated. The company can even mark certain programs as invitee-only or for researchers above a certain threshold.

Many programs already have rules saying they will not consider DNS/header related issues.

Quoted from the post:

> It was _immediately_ clear that Hammad was going to beg for a bounty, but it was a quiet Saturday night here and I thought it would be entertaining to see just how far down the rabbit hole he wanted to go. So, I responded, positively:

I suppose most of these useless bounty reports are quite easy to tell.

From the comment above:

> 20 mails each day

If you receive 20 mails a day to your security email address, then, perhaps it's time to setup a proper bug bounty program? They will weed out low impact vulnerabilities and only elevate the reports above a certain threshold. Isn't this a solved problem already?

I get that Troy is probably tired of receiving beg bounties, but as a security researcher himself, I find this post a bit distasteful and discouraging towards the people who could as well be on their way to finding bigger vulnerabilities.

Reports on lack of SPF/DMARC records on security headers can be annoying, and often false, because there are some legitimate cases an SPF record with `~all` is necessary, or you have to have a permissive CSP for whatever reason.

I would have just deleted their email and moved on.

This article sounds like an incoherent rant against CI/CD in general.

Coming from Jenkins, App Veyor, Circle CI, and GitLab CI, GH Actions was such a fresh breath and is a very cohesive solution to the cluttered CI space.

Most of the "points" mentioned in the article are merely code smells of not using a decent deployment/testing setup.

Having centralized build setups is not new either. Ubuntu PPAs and Arch's equivalent of package builds share similar pain points, but it's been serving us for decades at this point.

My "solution" is a $5 mug heating pad that pulls 16W. It only heats when there's a weight placed on. Probably accounts to 10kWh for the whole year to keep a warm cup of coffee ready for the whole day.

... which happens roughly every three years.

> 50000 spam emails daily

If I ever reach this level (still using my 2009 email address), I would just abandon this email address and start with a new one.

> ¹: retry is to refuse emails from unknown servers by default and force them to retry later with 451 error.

Interesting approach. Can you configure a low enough (try-again-in-X-seconds) value? Are you not worried that legitimate emails get dropped here? I imagine transactional emails to not try and resend later?

As browsers have reached the feature plateau, I still like the pace Firefox is innovating.

I'm using Firefox heta, and every time I jump a major version number, I get a bit excited to see what's new. Unlike Chrome (which I uninstalled on both my desktop and mobile devices), I know that none of the new features are mal-intended. Sure, Firefox messed up in the past (like Pocket integration), but they Firefox has been innovating for the past few years at a pleasant pace.

Recently, they added in-browser offline translation, enhanced cookie blocking,automatic cookie banner rejection, etc. In FF 120 (current beta), the only new feature I noticed was that they enabled "Copy Clean Link" context menu (which copies a link without tracking URL queries), and it's better than a browser run by an ad company sneaking in WEI or speaking at Ad Block Developer conference to say "Manifest v3 isn't that bad".

Instead of being a "guide" as it says in the title, this is merely comparing AV1 to other codecs, and ends by promoting their own thing. I don't think AV1 needs any "convincing", it's theoretically just better in every aspect. It's the tooling and hardware that needs work.

My approach is to write bash scripts that do the heavy lifting, and use of pipes and output redirection to coordinate the individual "steps". For example, one script would run the test suite, and another would process the code coverage reports.

In CI, it now just needs to run the scripts in the correct order.

... Or use Fossil?

I'd imagine Google reached out to Canva, ING bank, Adobe, etc and offered those domains for free, so it looks "adopted" by the industry leaders.

I was thinking about this too. Some TLDs look like an obvious obligatory money grab (such as .download), so companies are compelled to buy it.

I have seen some TLDs owned by a company and didn't even bother to set a redirect.

My anecdote is that the ICANN annual fee ($25k) is easily covered by these obligatory registrations and the premium domains. The cost of running nameservers aren't that high. NS1 has an offering, but it's impossible to find their pricing for anything.

Most gaming laptops' UEFI screens are so "gamer" it's cringe. Dell XPS series have UEFI GUIs that are quite neat and absolutely an improvement over the text screens.

It's good to see STG praised here.

I context switch often, and am so much more productive because of this plugin.

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA!

With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well.

Git also has release and commit signing with gpg/ssh keys, so the authentication is already solved.

https://github.blog/2023-04-19-introducing-npm-package-prove...