Spidler

I'm still salty about the loss of OiNK and the cruft of junk that is streaming services.

Finding new artists is near impossible with the profit focus of streaming services today. Spotify insists that you listen to product placement paid top one this week, no matter if you've just had a two hour session of death metal, it insists that you want to hear whatever top-star released last week.

Apple is similar, but on their personalization page will gladly confound artists with similar /same name, and _insists_ that Sunn-O))) is clearly _chill_ this week.

Not to mention that "related artists" suggestions are tame, at best. Unable to suggest "member of band <X> has a new solo project out now!" or "This band has split and two new ones may be interesting".

And let's not get into the part that they still cannot actually tell you when a band you listen to _start_ a tour, or do a merch-release for some reason, features that used to exist, but do not anymore.

Yet, for some fucking reason, there's a full middle page on Apple Music dedicated to music I don't enjoy.

A fast(er) & standards compatible way of doing ipv6+ipv4 connections.

- https://en.wikipedia.org/wiki/Happy_Eyeballs

Try this subscriber link <https://lwn.net/SubscriberLink/860262/29e92db3e7272504/> instead. (note, I'm not OP.)

Try this subscriber link <https://lwn.net/SubscriberLink/860262/29e92db3e7272504/> instead. (note, I'm not OP.)

I wrote a bot for GitLab that can do a few different things:

* Nag (Comment) on Merge Requests to tie it to proper release milestones and labels, something that is easily forgotten, or simply ignored by their UI due to the "never consistency" method of Javascript frontend.

* Create ChangeLogs from a Milestone, by traversing all the MR's merged during the time window, or associated with the milestone.

* Generate Wiki pages with above ChangeLog, as well as generating markdown templates with release notes as well

* Tag projects for release, automatically using above ChangeLog to generate a correct list of changes that has happened.

All this assumes a certain workflow, in our case time-based releases where multiple projects get tagged regularly for release, and development for a release is tracked in a milestone.

The tool is FLOSS, but it's fairly specific to my usecase.

As with many checklist items, it is a useful technology that when set up and followed, can be totally awesome.

Turning on and adding some "proper" filters on the audit subsystem won us the first spot in a CTF, as the early markers that "something is up" turned out to be excellent.

But if all you do with it is pipe it to your log server and ignore it? Well, then it's not really going to help you, and is only a checkbox item.

I feel that much of this disparaging on various "checklist" items is crappy half-assed semi-elitism. Checklists are _amazing_ tools for preventing accidents in many industries, everything from surgery to trains and flight use them with great success.

So why can't information security professionals use them without being derided by others in the business? Perhaps the same reason as doctors insisted that hand washing was time consuming and unnecessary, or the financial institutes that insist that oversight and auditing is unnecessary.

Ruined our day as well.

This price hike in combination with the change of how they count users made it a 1100% price increase for us.

It went from having active devs in the organization being paid users to "anyone with guest access to a subproject" requiring a seat.

It also went from "you can have guests at no cost" to "you must pay seats for guest access".

And it wants payment on bot accounts as well, as they ALSO use a seat.

So, our organization went from 7 active users and 14 in the organization, to suddenly requiring 30+ seats. This includes us paying for people who are ONLY involved in the Open Source projects we have.

And then the price hike on top of that.

Let me just say it leaves a really bad taste in my mouth.

Why not simply use that then?

We're using podman in containers inside gitlab ci.

We're _also_ running tests of containers inside containers in containers using gitlab-ci.

The main workaround we've applied is using crun as the runtime rather than runc.

Grafana seems amazing at first.

Variables to abstract out some, a bit of "repeat" to loop over something, and you get pretty drop-downs that you can combine to show nice graphs.

Then you think "I'll add it to a playlist". and you do so.

Then you think "my kiosk can't scroll this much for all, let's have one screen each for the apps" and you do.

And then you realize you cannot use variables from playlists, and you cannot template screens.

So you make eight copies of your screen, one for each variable configuration.

And you edit each copy of your screen to set the variables, and save it.

And then you realize that there was a typo in one panel.

So you go in and edit in eight different screens to fix that typo.

Then you realize that it doesn't look good on the TN panel, so you need to change a few colours to get better contrast.

So you do that on eight different copies, by the means of clicking in every pane, navigating through the point-n-click and then pressing.

But you realized that you learned this, so you're fast, and use the keyboard. Except then the change doesn't take.

Because grafana requires you to click in another field after you've edited, or your change doesn't hold if you press "Escape" or other key to navigate back.

And that's how I learned how Grafana is best of breed in GUI dashboard tools. Sort of how a pug is best of breed in a dog competition.

A few years ago we migrated from Jira to Gitlab. To use their project-planning features (Epics, etc) they take a massive preḿium if you're not interested in the other features.

Still, the basics are sound, and even without epics and a few of the other neat but expensive features, it goes pretty far.

From the article:

> The pouch cell as described, can provide ∼1 mA of current. At the typical operating voltage of ∼0.5v, each cell can provide ∼0.5mW. The cell is robust to at least ten cycles of charge and discharge without noticeable loss in capacity. An array of 6 cells is thus sufficient for low current electronics for sensing applications (such as low power microcontrollers like Texas Instruments MSP430).

It's research into making safe, DIY rechargeable batteries, which is pretty damned cool.

New, secure, VM..

    sudo chmod 777 /dev/kvm

But... but... almost.

What I'm missing is a different security model than the current `If an endpoint can push to gitlab, it is trusted and can execute code server-side`.

There is no (current) way to enforce a 2fa step in order to push to a repository, and while you can technically implement them, that doesn't mean much, due to the nature of `git push`.

What I want is a 2fa-enabled review boundary between "commit" and "execute", which currently isn't possible.

Protected branches can be unprotected without an auth step.

There's nothing on the server-side that signs `gitlab` generated merge-commits in the commit graph, so no way to distinguish them from other merges.

There's no security boundary to change the deployment details, or to modify the deployment pipeline to run from a different branch.

Basically, I'd want a way to ensure that there's an authenticated hand-off between "commit" and "deploy" steps on the chain.

Also, it'd be nifty if one could get gitlab to maintain a version number, increasing with every merge request merged, in order to get smooth tagged builds when MR's are used.

Yes, we're using Fedora Server in production, since for some uses we really want a modern userspace and kernel 4.15+.

LWN.net gets a bit more than $5. You pay to get quality content a few weeks ahead of time. Well worth the money.

Machine learning, aka. "Mining your data for bias".

Also, because curl is c89-portable, and alloca might fail on the portability standpoint.

A thing I've found to help people about that is to override __repr__ on bytestrings in python3 and bytes in python3.

If you make it not print strings as "ascii" but as hex, people grasp the difference easier.

how's their update schedule for Security fixes and OS versions?

How botched are their security lockdown of their phones compared to the Nexus line?

Can't seem to find a list of CVE's fixed with each update (not in their changelogs, that they only post on the forum...) , based on that, they do not fix known security problems.

But you cannot cluster on a BRIN index, and isn't cluster an operation that you need to redo regularly?

I thought so, since while the cluster flag is set on an index, it won't guarantee future writes to be clustered.

Since you can issue the cluster command to update the clustering.

So, I wonder how you are to maintain the setup.

UUID internally is a 128 bit integer. Cheap as hell to sort.

No, see [the previous post](http://rachelbythebay.com/w/2016/04/17/unprotected/)

Our [API](https://www.modio.se/pages/api-doc.html) documentation is public, but that makes for little value, as identification is made using TLS certificates.

Yes, the API is public, but you need a Cert bound to your user data to get anything from it.

Couldn't it also work to prevent getting cores into deeper sleep states?

"We apply a scorched maybe tactic.".

First we strong arm current implementations, forcing them into a Private API that we 'intend' to make public. Sort of how we intend to go to the gym, intend to drink less and intend to think about how our actions affect others in order to be better people this year.

Wait. Why would we believe this statement? Why would the people who willingly implement your private API care about it going public?

This "intend" is as much worth as the intent to build a comprehensive test suite and intent to document the code later.

Americans are too strung up on the "be ashamed for someone" comedy that really doesn't go over well with Scandinavian audiences.

It's hard to find an American comedy (since Wag the Dog, perhaps) that doesn't fall on the gag of fremdschämen.

A typical example of the bleak humour from here would be the Danish movie [Flickering Lights](https://www.youtube.com/watch?v=XE4ZBcK01HU)

Malware. That's why.

So, more like New Orleans than Texas?

But be wary so you don't pass in floats when creating your decimals

    In [10]: from decimal import Decimal
    In [11]: Decimal(0.1) + Decimal(0.2) - Decimal(0.3)
    Out[11]: Decimal('2.775557561565156540423631668E-17')   

    In [12]: Decimal("0.1") + Decimal("0.2") - Decimal("0.3")
    Out[12]: Decimal('0.0')

I'm not the same author, but I run several Webapps in systemd units, with the below service for all of them:

Note the @ in the name, that means I reuse it as webapp@api.domain.name webapp@frontend.domain.name and so on.

----8<---- webapp@.service ---->8---- [Unit] Description=%i webapp

    [Service]
    User=%i
    Group=%i

    # Note that the first argument of the command line (i.e. the program to execute) 
    # may not include % specifiers.
    ExecStart=/srv/webapp %i
    WorkingDirectory=/srv/%i/

    PrivateTmp=true
    Type=simple
    Restart=always
    RestartSec=2s

    [Install]
    WantedBy=multi-user.target

---- 8< ----

/srv/webapp is a simple script that will do "exec $1/webapp" which is the actual executable.