Ayesh

I wonder if Git provides a pluggable hashing mechanism as part of SHA2 migration.

I imagine stuff like this and SVN to Git mirroring to work nicely with identical hashes.

.cz is certainly up there, at least under current nic.cz: https://en.m.wikipedia.org/wiki/CZ.NIC

They strongly push for DNSSEC, supports a bunch of OS projects, etc.

> transfer my wealth

I don't think _anyone_ is against using cryptocurrencies as a way of transferring money. It doesn't make sense to transfer wealth via something that rapidly changes its value, right? Because means of transferring wealth requires preserving the value of the wealth. Bitcoin today does not preserve its value, as evident by the rapid decline in value in the past few days.

We recently placed an order for custom-built LiFePo4 batteries with various voltage and Ah ratings, including custom branding. For an entire order of 200 batteries, they assembled, packed, and shipped within 4 days.

A similar order would have taken about a month from Germany, at about twice the cost. Most of the US manufactures don't even take custom orders at our small scale.

Three HN top posts about Twitter, Lyft, and Stripe laying off people, and looks like just a start.

In Twitter's case though, the writing was in the wall ever since Elon fiasco began.

I started to use Duplicati 2 for about a month now to try it out, and it was working flawlessly for me, except for occasional time-out of the web UI. I only backup local directories, and the destinations I tried out include an external drive over USB, Google Drive, and an SSH connection.

I'm using it to backup a Firefox profile while I'm using Firefox. It backed up active files as they are being written too! I'm also using it to backup a Veracrypt container file (single 24GB file), and incremental backups worked quite well too.

Thanks for the words of advice, I will keep testing longer before I make the switch.

Sounds like a great deal! I did try to game the EU roaming by using a Polish carrier SIM in the Netherlands, which in theory should work for a few months each.

It is, and that's their catch. That number is only for 2FA SMSs, when I have deliveries, or when something requires a phone number verification. WiFi is plentiful everywhere nowadays, so I didn't have to activate this absurd plans in months.

Yeah the $10/GB price is the catch. In reality, I haven't activated any of these plans in months. The credits have unlimited shelf life (as long as I make a call/SMS every six months), and it has been working great.

Mostly for incoming SMS 2FA, and to use as a phone number for deliveries, forms, etc.

Use prepaid.

I don't see why not many people see the appeal of prepaid SIM cards. Just buy an unlocked phone, and pop in a prepaid SIM card or install an eSIM profile. That's all it takes.

I rarely make phone calls, and haven't send an SMS in years. WiFi is everywhere, so all what I use the SIM card is to register with shitty 2FA providers that dont support TOTP/WebAuthn. The catch with prepaid SIM cards is that phone calls, SMSs, and mobile data are quite expensive. My carrier charges 9,95 euros for a 1GB bundle. I only use mobile data when I need to look up directions or something small that even a small package with a small data cap, or a package with unlimited data at slow rate does the job.

Context: Netherlands, using KPN prepaid. I understand postpaid packages are more common in the US and prepaid cost a lot more too.

Composer (PHP) also does this. There is a package lock file that directly binds to a specific git commit, and all "composer install" builds are guaranteed to be identical for the same lock file (unless someone pushes something else under the same sha1, but that's Git's problem).

Packages are downloaded directly from GitHub or whatever repo configured.

Yeah, I recently started to use KDE Plasma with Fedora (after Gnome left a sour taste), and the amount of customizations it allows is mind-blowing. This may be common knowledge, but as a newcomer to KDE, these very precise controls are quite a fresh breath from OSs like Win10/11 and Mac OS.

Reminded me of those Windows 98 shell customizations. Windows seems to be going backwards when it comes to customizations; there are only a few customizations allowed in Windows 11 now.

Just an speculation; for an x.509/web of trust related vulnerability, I expect the CAs to be a prominent target. There are hundreds of them, and I'm pretty sure there are at least a few of them that use OpenSSL somewhere in their certificate issuing process. Just to avoid DigiNotar-like fiascos revoking certificates en-masse, it probably makes sense to give a head-start to CAs.

Related: https://httpd.apache.org/docs/2.4/mod/mod_tls.html

I will try this out next week to see I can get Apache to compile with mod_tls; should be interesting.

In the linked article, Global sign says they don't know what exactly the vulnerability is. I imagine the public root CAs to be informed if this was an x.509 related bug. But again, Global Sign is a pretty shitty CA to begin with, so I wouldn't be surprised if they were not informed intentionally.

I highly doubt it.

I have done security releases before (not in OpenSSL), and the first line we have there is that don't push upstream in the flashiest text possible. In OpenSSL's case, they might share it with other major OSs beforehand (because many software statically link to OpenSSL), but there is always a secure channel in place to make sure the patches/commits are not leaked.

In the unfortunate event that the commits were pushed to a public repository, the most sensible thing to do is to just release the tagged release with the security announcement anyway.

Yeah most routers come with a fixed list of services, when they really mean is a list of protocols.

I have a Huawei Fibre ONT, that only listed DynDNS, NoIP, and a few others. I could get away by using a NextDNS DNS override, and hosting my own script that forwarded the API call to the actual DDNS provider.

Right, these are awful I totally agree.

There were even some incorrect type casting specially with numbers and "numeric strings", which were fixed recently.

I use strict typing in every new piece of code I work on, which largely fixed the problem.

Laravel, while being extremely popular, isn't exactly the flagship choice for "quality code", not even Laravel claims it to be. Symfony framework gets a lot of things right, and IMO the showcase for more modern PHP.

Looks like you can't see the sheet without logging in?

F3 is pretty good, I still run it in a few applications. It surprisingly held well with PHP 8 migration as well.

However, the reason why I don't use F3 anymore is because of the god-object model. You are pretty much carrying around the `Base` class everywhere, and you are golden as long as you stick with what's provided with F3. However, it's difficult to adapt to more modular applications that you mix and match template engines, routers, DBALs, and a DI containers.

I can HIGHLY recommend Slim PHP. The version 3 is a little bit opinionated, and the 4.x is more modular. So pick your poison.

F3 has a ton of functionality in a surprisingly small package. If F3 covers all of your requirements, go with F3. My grudge with it is that it's not as easy to decouple as Slim, which mostly stays away after it does it's thing.

Do you want to elaborate a bit more? Which features that you saw as footguns.

You just keep adding types, it gets better by time. When you do add types, go with strict types (strict_types=1). Type errors pop early when there are many type enforcements.

When you find parts that you can't easily type (open file handlers for example), you can create wrappers that encapsulate the handlers.

Also, use phpstan/Phan or other static analyzers like others mentioned.

It's too late for me in my time to pull my thoughts together, but this goes on the same lane as Nigerian prince scams, cryptocurrency/ICO scams, etc.

It's like if your lie is so bad, and if you can still get a small amount of people to believe you, they will fall HARD to it, and you can scam them multiple times because they continue to fall for them. That's the target audience.

Yeah, we had an overwhelming majority of Dutch users using iDEAL to a point that we didn't see any decrease in sales when we had our credit card payment gateway down.

I believe you need to sign up with a Dutch acquirer/CPSP to get iDEAL payments sorted out, so there is an entry barrier for many international shops to accept iDEAL payments. This is pretty much the same for other payment providers such as CB, UPI, LankaQR, even AliPay too, so that effort is probably worth it.

Honest question, is there are Matrix client that has a decent amount of UX work gone into it? I recently started to use Fluffy, that looks pretty good with a nice clean design, but does not have the same level of polish as Telegram, at least not yet. It's open source and one should try to contribute and not complain, that I figure, but not everyone can contribute in the first place.

Yeah I don't even know if that upper post was meant to be sarcastic. Telegram, despite the security theater, is amazing UX-wise. It's such a joy to use and I see myself more and more engaging with Telegram contacts just because it's convenient in many subtle yet impactful ways.

Yeah, I almost never consider an Airbnb nowadays for these extra costs. Hotels do this too (with city tax for example), but that is just a few extra dollars a night, and not almost as high as the cost per night.

I think the original spirit of someone renting out extra space they have is long gone. It's either a big company renting out what could have been rental units in the first place, or someone renting their place but you have to almost beg them to be flexible with timing, amenities, etc. I would feel much more comfortable complaining to a hotel if the beds are dirty, as opposed to an Airbnb host.

GitHub does a pretty good job requiring oauth or ssh key authentication, and the new finely-grained personal access are awesome, I just switched all my apps to use more locked down PATs.

The far you reach from GitHub's ecosystem, that's where most of the vulnerabilities are.

Repo-specific deploy keys, read-only keys and branch protection are my "pro" security hardening steps.

Shoving all secrets in ENV isn't a clear improvement either. Sure, most CI services attempt to mask them, but it's trivially to extract the secrets. For GitHub, you have to approve incoming first-time PRs, but it's a huge vector someone determined can exploit.

SHA3 is relatively infrequent compared to sha1/2 and md5. SHA3 also has a few variants, and I don't know for sure if this vulnerability is present in all variants.

The vulnerability is only present in the reference implementation. So it's unlikely that other implementations (rush as Rust or Go) are vulnerable.

I tested with the latest released and master branches of PHP, both of which segfaulted for the code samples mentioned in the article. The article says Python is also vulnerable.this is because both of the languages apparently use the reference implementation.

Ethereum uses SHA3 quite extensively, but I doubt it's vulnerable post migration from PoW, let alone it's unlikely that they use the vulnerable implementation/variant.