_cenw

I'd even say it was institutionally tolerated to have a cheap workforce with a built-in ejection seat.

The default cache action also has issued with anything that isn't owned by the runner user, and caches are per-repository, so you can't just have one cache like you do for binary caches.

In my experience, the default VM size is so slow, you probably don't want Nix on a workflow that doesn't already take minutes.

Even with a binary cache (we used R2), installing Lix, Devbox and some common tools costs us 2 1/2 minutes. Just evaluating the derivation takes ~20-30 seconds.

> He surrounded himself with yes-men that know perfectly not to contradict him.

Stephen Miran is believed by some to be the "mastermind" behind this. I'm not sure Trump has ever had a singular original idea.

Ah, share gameplay data. The thing every modded switch has turned off.

This fearmongering about Microsoft has existed since the very day the first TPM shipped, and it has never come closer to being real.

Most of the security improvements shipping in Windows are leftovers from Xbox, but they very clearly state that Windows Security does not treat the user themselves as a threat.

See the slide around 4 minutes into this talk: https://www.youtube.com/watch?v=U7VwtOrwceo

I'm sure it's an honest attempt to move the baseline for security up and shake off the "Windows is insecure by default" perception they've been fighting since introducing UAC.

Though it is definitely not required, IoT LTSC does not have these requirements.

What's the big monopoly anymore? Almost everything runs on variants of Wine. Even Anticheat, if the developers care enough.

Rufus has always maintained that they'll inject an answers file for as long as that works, but not patch Windows ISOs in any more hacky way.

I would not put one of those builds on my network, and I'd also expect this to have very imperfect compatibility (e.g. quite a few games need Edge WebView, and these usually rip it out). And you get maybe 1-2 extra FPS. And Windows 11 LTSC is right there.

I have one of their travel routers (Beryl), and they beat a U7 Pro (the one with horrible still unfixed firmware) in consistency and throughput with one device connected to 5 GHz. While I sit next to the UniFi AP and the Beryl sits behind a concrete wall. And it's not a small difference either. I run it in AP mode for game streaming now because the UniFi keeps dying, even when I'm the only device on 6 GHz.

The polish I'm missing on supposed premium products.

It's Xen, and they even explain why it's not KVM here: https://github.com/edera-dev/krata/blob/main/FAQ.md

This is the purpose of the not so well known audience claim.

Though I'd still prefer to authenticate to something like Vault's SSH engine and get a very short lived SSH certificate instead. No new software to install on your servers, just the CA key.

I feel like we took the wrong lessons from atrocities in history. We treat them like they happened before some special enlightenment that magically shields us from history repeating, so it's okay to face the early warning signs with apathy or paint anything as a difference in opinion. Surely someone will care when things escalate; surely there would be an outcry more loud than this if it was serious.

Maybe teaching about the holocaust should be accompanied with copies of daily newspapers from the late 1930s to demonstrate their mundanity.

Cowardice.

Fence-sitting these days is a political decision all by itself. Well, it always was, but now that we've established a new normal (that's not very normal) rooting for the status quo is even more partisan.

Hungary just criminalized pride. Their political leadership seems more aligned with Putin than the EU at this time.

https://www.hrw.org/news/2025/03/20/hungary-bans-lgbt-pride-...

Don't forget the concern trolls that imply doubt of it happening at all, and then downplay the severity if you dig a little. We have some in this very thread, deploying their "scare quotes".

The government employees at these border crossing definitely feel too confident that whatever they do will get covered up or ignored by the people above them. And all trust I ever had in the forth estate - nationally and internationally - has gone with this entire mess of a presidency too. They mostly seem to parrot each other's assurances that things that are happening are completely normal, or at least understate heavily. I'm happy outliers exist, including some unexpected ones like Wired Magazine.

And the results are in.

"Our engineering team has indicated they will not be able to fully dive in and implement any resolutions in the near-term."

Considering they didn't in the past 7 years, I have little hope for the next 7.

GitHub Actions is like Microsoft Teams. Nobody who knows better wants to use it, but it's slightly better than what most did before (email/jenkins/nothing) and came with the thing you're already using. At least your boss thinks it's better. And it's such a good deal!

They are so identical, there's code in the GitHub runner to search and replace "Azure DevOps" with "GitHub Actions" in log output on the fly.

The entire code is a wonderful mess. We found that when we early-adopted ephemeral runners, that the control flow is full of races and the status code you get at the end is indicative of exactly nothing. So even if the backend is just having a hickup picking up a job with an obscure Azure error code, you better just throw that entire VM away, because you can't know if that runner will ever recover or has already done things to break the next run.

You may notice the button with the two opposing arrows on top of the user menu. You should click on it.

I still miss that one team that did async work extremely well. On my current team - fully remote, but siloed knowledge due to lack of capacity - there's a high chance that things go missing in dailies.

I should've tested this endpoint. GitHub's SAML implementation is done by a different team, always lags behind in quality and does some pretty unclean patching of the data - i.e. the notification filtering is done in the templating engine, so if all your notifications are SAML gated you get the header, no "all caught up" below it and (this is live from my account) "1-0 of 113".

So I'd give it about a 50:50 chance of working.

Edit: I just realized it eats your non-gated notifications too, if they're further down than position 25, and the "Next" button just leads to the same page with "?query=". Yay, another ticket about how glued on GitHub Enterprise Cloud is. The last one (GitHub eats API calls to accept invites to SAML organizations, deletes the invite, and sends a 200, writes success to the audit log... but ends up being a no-op) only has been 2 months or so ago. Thanks Microsoft.

Yeah, it's a massive UX issue. The way to actually check if someone has a SAML session is to attempt to get their membership. If you get a 403, there isn't one. But good luck explaining to the user that they need to click "authorize" next to the organization in the OAuth flow. No way to send a hint that it may be required, and no way to do a step-up flow.

I did a full writeup here: https://notes.acuteaura.net/posts/github-enterprise-security...

They just don't get that some people can't spread their time into perfectly equal slices of productivity. Remote work and flexible time has allowed me to work a big productive burst in the morning and in the late evening, spaced way more than 8 hours apart, with busywork somewhere in the middle. Probably wouldn't work this well if I had to do that in an office, in a single 8 hour (or 4+1+4) segment.

GitHub's SAML implementation is useless. The idea is that you can bring your own account into an enterprise, and that sort of works on the site itself, but it does not prevent apps where you log in with GitHub from reading your organization membership once you have authorized an app on the organization level (and if you didn't, it hides the membership from oauth tokens, so it has this capability!).

A SAML session is only required if said app fetches data via a token obtained from that user - and in my glance around, this was almost never the case - SAST tools almost always use app instance tokens and are happy to show anyone with a GitHub account in your organization your code. Tailscale fixed this when I pointed it out, Sonarcloud told me to please don't tell anyone and GitHub took a few weeks to say this is totally expected behavior - when no vendor I told did, and their docs contradicted them.

I swear, reporting security bugs is a thankless endeavor, even if you just randomly stumble over them. I couldn't imagine doing this as a job.

Unfortunately there's quite a market gap if you need bandwidth. I can't just pay HE 10 bucks a month, their service doesn't work that way. Hetzner would work, but their IP space is very often randomly blocked from lots of things.

If someone else provides IPv6 connectivity to you, you use their bandwidth. Some apps like Steam see IPv6 connectivity and use it regardless of what you'd prefer it to use, hinting mechanisms and all. So while I just wanted to use the tunnel for things that IPv4 does not provide, I always end up tunneling half my traffic over it, which free services don't like.

I wish Happy Eyeballs worked better or let me absolutely prefer IPv4, because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers on a cheap VPS separately. Or the tunnel is so slow, I'm degrading my entire internet connectivity.