Znafon

Some work as started to have a built-in connection poller on January 2019 so it will probably be available in PostgreSQL someday.

> My only frustration with this release announcement is dropping Python 3.5 support now. Because Python 3.5 is not EOL and used in LTS OS releases that have vendor support through 2021, this forces us to choose between our policy of supporting vendor OS releases until they reach EOL, not upgrading to Django 3 for the next year or more, or shipping our own Python on Ubuntu Xenial.

To be fair, I think the next LTS release of Django will be the last minor release before 4.0, 3.0 is not LTS.

People sign their vote, I'm not sure how the details work, you will need to look at the details of Devotee, look at https://lists.debian.org/debian-devel-announce/2019/04/msg00... and https://salsa.debian.org/debian/devotee

I think you will find Debian election process interesting for what you are trying to do : https://www.debian.org/vote/2019/vote_001_tally.txt

We just got bite by a bug were Catalina would randomly delete some Wireguard tunnels. A temporary workaround to restore them has been published in the Wireguard client but Catalina doesn't feel stable at the moment.

You can get this with standard pip by setting the PIP_REQUIRE_VIRTUALENV env variable.

Thanks, this was exactly what I was looking for. I'll start experimenting with it :)

I think RDS has some very strong pros:

  - not so bad pricing
  - good defaults
  - no need to worry regarding the backups and easy disaster recovery
  - some monitoring out of the box
  - support TLS with a valid cert out of the box
  - easy replication

I'm not an ops so not having to worry about the operational aspects of our datastore was great.

Here are some pain-points we have, I'm probably forgetting some but those were really painful:

- You don't have a superadmin access, we had several issues where some tables, sequences or objects where associated with a user we wanted to delete and this was really hard, I think we were supposed to change the owner of each objects one by one. [0] shows the issue. In the end, we solved it by dumping the database, deleting the user, recreating the database. Thankfully, this wasn't in prod.

- Many extensions cannot be installed, for example Timescale. It's a bit sad having PostgreSQL and not being able to take full advantage of it.

What I regret about those is that there is nothing you can do, for the first point I looked everywhere and many have this issue but there is nothing you can do to solve it easily, there is posts both on StackOverflow and PostgreSQL mailing list but no easy solution, you have to track one by one the object whose owner you want to delete and reassign them. For the second, it means you can't use many useful extensions like Timescale or anything not yet released.

If there was some AMI with PostgreSQL already installed and correctly configured on which we could just connect an EBS, we could migrate very easily.

[0] https://stackoverflow.com/questions/44718654/cant-delete-pos...

> RDS not supporting custom extension is RDS problem and frankly I wouldn't recommend using RDS.

We are using RDS and would like to have a standard PostgreSQL instead. Is there some community supported AMIs that could help us to get started quickly?

You may want to have a look at ORCHIDv2 which uses a subset of IPv6 to distribute cryptographic identifiers. I think you could use them for this purpose.

Is DHCP useful to enforce network policy? What about users who manually set their DNS servers?

Wouldn't be a proxy checking the SNI of connections you open better?

We do, we found that having a no releases on Friday policy was just an excuse and diverting us from actually improving our CI/CD, monitoring and alerting infrastructure.

We invested work on those and try to deploy as we can.

It works great for us but obviously you need to try and see what does for you.

> I realize that the UNIX philosophy (everything is a file) is dead

Was it ever alive? As far as I know lo0, eth0 and others where never accessible as a file interface and we still rely on them. Is there something to gain to give them a name on the filesystem?

Morality is subjective, Seth Vargo thinks the way ICE enforces the law is not appropriate and choose not to help them.

Wether or not you share his moral beliefs does not seem important to me, you can recode chef-sugar if you think the way ICE works is fine and we should help them.

This makes sense,all organizations are different and it is true that all changes to the kernel tree are publicly ACK-ed before geetting committed.

Maybe we could make a note of the public key that pushed each commit to the repo so we get the best of both ways, each commit is associated to a user from it's public key, not just the Author field and tags are signed by GPG.

You would already get a conflict as the history of the repo changed and signing all commits as some drawbacks as Torvalds explained here: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...

I'm not sure it's better.

You may be interested in Sentry's data scrubber to remove things like credit card numbers, password and API keys: https://github.com/getsentry/sentry/blob/95767d455b8004ec4b4...

I'm working on this to add TOTP support, I will publish it when it's ready, you may be able to reuse some parts of the implementation.

Wg-quick from the same project as Wireguard supports pre/post-up/down Hooks. You should be able to very easily write a post-up hook that read the rules from the server and a pre-down one that delete them.

Since your are connected to the server using Wireguard, you don't need to check its identity you can just open the correct port, read the rules and apply them, a simple Python or Perl script should be able to do what you want.

I think my issue what binding Consul to docker0 while Docker is starting. Half the time the interface wasn't ready. I don't remember exactly how I fixed it but with SystemD you can just specify a dependency.

I think I had one where one service was trying to bind to a network interface that wasn't ready, maybe docker0. It was painful to find and fix.

> When I want to write a script that runs on startup, I expect that I can just put (or link) it in some directory where the scripts are that get started on startup

This is not very specific, have you never had any race-condition with this? There is a reason SystemD ask some informations regarding the service that needs to be launched. I don't see how ignoring those makes a good argument against SystemD.

If reading the message require those 5 HSM, how does your recipient can read your message?

There is some reference to this in French:

> Les droits d'enregistrement de Karajan n'étant pas disponibles, c'est la version de Karl Böhm, avec l'orchestre philharmonique de Vienne, qui fut créditée au générique. Mais au cours de la postproduction, Kubrick remplaça discrètement l'enregistrement de Böhm par celui de Karajan et personne ne le remarqua3.

https://fr.wikipedia.org/wiki/Ainsi_parlait_Zarathoustra_(St...

Yes! And Kubrick knew this: for "2001: A Space Odyssey" he bought the right of "Also Sprach Zarathustra" directed by Böhm and replaced it at the last minute by the one directed by Karajan hoping no one would notice.

You can get phised to enter your two factor in a random web forms but it is not possible to do this with U2F (https://en.wikipedia.org/wiki/Universal_2nd_Factor).

For example, Google reported that deploying U2F blocked all phising attempts of their employees : https://krebsonsecurity.com/2018/07/google-security-keys-neu....

Why push for extended validation of there is no security benefits and the user experience is the same?

I remember that someone had successfully got an extended certificate for "Stripe, Inc".

Things like certificate transparency log monitoring seems better than EV to improve security.

> WireGuard doesn't work over TCP.

I see this repeated in a lot of places about WireGuard but is there anything wrong with UDPTunnel (http://www.cs.columbia.edu/~lennox/udptunnel/)?

Why would one prefer this instead of WireGuard + UDPTunnel?

Packer can be lower level but it can also do what Dockerfile do, see https://www.packer.io/docs/builders/docker.html for the Docker support in Packer.

If you really wanted to align your clauses, you also could do:

     if (false){
     } else if ($var=='possible value 1') {
       echo $var;
     } else if ($var=='possible value 2') {
       error_log($var);
     } else {
       // do nothing
     } 

Now we just to find somewhere where it would be a good idead...