defanor

Thanks! Tried it with (k)nsupdate, and it might be nice to add them into snippets and/or documentation. E.g., using the same placeholder names as in the documentation:

  $ nsupdate # or knsupdate
  > server update.dynip.dev
  > zone YOUR_DOMAIN
  > key hmac-md5:key-YOUR_DOMAIN YOUR_BASE64_KEY
  > update add YOUR_DOMAIN. 300 IN A YOUR_IP
  > send

Thanks; it is the same login as here, at steady.mooo.com.

Attempted to register, but the verification message does not arrive. I did not see anything resembling it in the mail server logs right after registration, and there is still nothing in the mailbox after 6-7 hours, with a few requests to resend it.

I prefer and use the knot DNS server for authoritative DNS (and either knot-resolver or Unbound for caching DNS servers) myself: it is quite feature-rich, including DNSSEC, RFC 2136 support, an easy master-slave setup. Apparently it does support database-based configuration and zone definitions, too, but I find file-based storage to be simpler.

The FF reader view here starts from "We just saw how a Decision Tree", gobbling up half the article. Simply disabling CSS works better. Though in both cases, it seems that ordering might be a bit mixed up.

There is also the "No multi-floor/multi-map support" point. Apparently it is treated less seriously than others there, and omitted here, but seemed particularly unfortunate to me: having per-floor dry cleaning robots seems wasteful, while in that text it is assumed that they should be fully autonomous (no manual transfer of those between floors), and likely with large and frequently used docking stations for wet cleaning.

(FWIW, I do not use multi-floor robots myself, only using an old random-walking Roomba in a single-floor setting, but considering getting another robotic cleaner for a two-floor house, where it does seem reasonable to manually move it between floors, as I would move any other cleaning tools.)

(Sorry for the relatively long post; it so happened in an attempt to explain my point of view in more detail. I think variations of that do come up in such discussions, but staying unnoticed or dismissed; maybe this one will succeed.)

Probably because of my limited usage of Sequoia, but it seemed compatible enough with GnuPG (when it comes to OpenPGP, that is; not their CLIs or APIs): not completely, but enough in practice. The cryptography also looks modern enough to me: it is not like even GnuPG defaults to compatibility with particularly old systems.

If they were notably incompatible though, I guess I would prefer GnuPG for the availability and compatibility reasons, as mentioned above, mainly to avoid fragmentation. Though if there was a better system, as versatile, preferably as easily available, even if not as widely used, I would consider that as well.

Apparently the threat models we have in mind, along with the settings to use those tools in, differ: as mentioned in the sibling comments, my concerns (or past concerns, current issues to deal with) are more about availability, confidentiality in the face of mass surveillance and over varied channels (i.e., versatility). I see (and hear of) people neglecting cryptography altogether in cases where cryptography would be beneficial (for confidentiality, most often), the local government and other threat actors focusing on heavy-handed and basic attacks (aiming to disrupt use of cryptography, such as by blocking the IMs they do not control and other online services, or--perhaps even more often--making use of it not being used at all in the first place); so I struggle to see how, say, age + minisign would have helped anyone over GnuPG in such conditions, or even those rare few who are targeted individually. But I find it much easier to see how a wider adoption of any sufficiently good, versatile, available, and standardized/compatible tools would be useful. So that people would be able to communicate securely using those, as well as the same person would be able to easily decrypt a file they had encrypted years ago without keeping around a toolbox of varied--and likely partially abandoned--tools, which, taken together, would likely be a worse legacy pile of software and algorithms than OpenPGP and its implementations, moving the specification with its different legacy options into users' heads (and replacing the implementation with their manual operations).

Of course everyone having and properly using a set of most polished and foolproof tools implementing algorithms considered most secure (out of practical ones) at the time would be good, but there are issues with adoption, software acquisition and updates, interference (i.e., adverse conditions, including blocking), key distribution, as well as the moving target (changing recommendations/views) to take into account. The algorithms, implementations, and UIs are not to be ignored, but neither are they everything there is, so one has to prioritize all the components.

I have no issues with it, and actually happy to see alternative implementations. Possibly because I did not use it much, but it does look fine to me. Not as a complete GPG replacement yet, since some software still depends on GPG, but a viable one, and a suitable one for most of the manual CLI usage (ignoring that its version on slightly older systems has a different interface, adding a bit of confusion; hopefully it is stable now). It was not listed among suggested alternatives in the linked article though, and from what I gather, the author would not be happy with it, either.

> security under a hostile setting

Yes, but security usually includes availability, and I mentioned a setting with service blocking above. Like that by a government.

> (Centralization itself is a red herring. One may as well claim that PGP is centralized, given that there’s only one prominent keyserver still limping around the Internet.)

How is it a red herring?

> For messaging/secure communication, use Signal. It’s open source.

From my point of view, it is complicated by Signal being blocked here (and it being centralized helped to establish such blocking easily), likely the phone number verification won't work here, it is not available without a phone, and it is not available from F-Droid repositories on top of that. Currently money transfers are also complicated, so finding some foreign service that would help to circumvent phone number verification is also complicated, and not something I would normally do even without that. All this Internet blocking is a new development here, but such availability issues due to centralization were anticipated for a long time, and are a major motivation behind federated or distributed systems. Some mail servers are also being blocked, but generally mail still works, and less of a pain to use.

> For file encryption, use age. It’s open source and has multiple mature implementations by well-regarded cryptographic engineers.

> For signing, use minisign, or Sigstore, or even ssh signing. All are open source.

These I find to be okay. Having to install them in addition to GnuPG that is usually already available, but that is to be expected; they are available at least from Debian repositories, so not something to complain about when considering alternatives. Likewise with the key sharing: not getting to reuse OpenPGP's PKI, and will have to replace that somehow, but it is not like it is used widely and consistently anyway, so perhaps not much of a loss in practice. Likewise with familiarity of the users: I would expect a little more friction with such tools, compared to GnuPG, but not much more. And I don't see actual usage downsides apart from those. Though the benefits also seem a bit uncertain, but generally that sounds like a switch that makes sense to consider.

This OpenPGP and GnuPG criticism is brought up regularly here, but the proposed alternatives come with their own downsides: some of those are proprietary, some are centralized systems or depend on such. In addition to all the inconvenience, when such centralized systems are blocked, casual users switch to explicitly backdoored options. The advertised IMs are tied to phone numbers, introducing both privacy and availability issues. Almost nothing of that is available from Linux distributions' system repositories. Integration with other software and infrastructures is lacking. Dealing with multiple specialized tools is more of a headache even for expert users, especially when their added benefits do not make much sense given one's threat model. OpenPGP/GnuPG is more resilient and versatile than those, still usable where those are not.

I think such an article would seem more convincing, at least to me, if more sensible alternatives were proposed. Ideally without the advice to not encrypt email, without assumptions of continued availability of all the online services, of trust to certain third parties, and so on. Or it could be just a plain criticism without suggestions, which would still be somewhat informative.

Edit: there is another list of alternatives in a sibling comment, advising against (well, actually being quite hostile towards, and generally impolite) usage of what I had in mind as one of the possible more sensible alternatives: XMPP with OMEMO. Though upon skimming the criticism of that, I have not found it particularly convincing, either, and it just looks like some authors try to be particularly provocative/edgy.

I thought the point is to pass along the message, though the one that is brought up quite regularly: sharing the joy of making websites, and such making as a way for anyone to contribute a little to the overall construction/improvement of the Web. Besides, it does seem to work without JS, though the layout is quite broken: header texts overflow (whatever is the window width), the text column is 45 characters wide instead of occupying the window width, all of which demonstrates the possible downsides of such diverse websites. That is not to say that they outweigh the benefits, but such downsides are not necessary to include, either.

In my desktop Firefox it does not fit horizontally, and it is not scrollable: I had to maximize the window in order to uncover the keyboard completely.

Neat, but it takes two pages on printing in the landscape orientation in Firefox on either A4 or US letter paper sizes here, with minimal font size set to 16. Generally matching of text dimensions to container dimensions is unreliable if you take into account browser settings (not just minimal font size, but also things like differing fonts and disabled custom fonts), and perhaps an SVG image with pre-rendered texts would be more appropriate for such a task. Or even a more pages-oriented format, and for different paper sizes.

Pixel 6a used to show a September patch as the latest, but tapping "check for updates" found a new one. As mentioned in other comments here, apparently tapping those buttons twice may help.

> We're so ready and willing to punish individuals for harm they do to other individuals, but if you get together in a group then suddenly you can plot the downfall of civilization and get a light fine and carry on.

Surely "plot the downfall of civilization" is an exaggeration. Knowing that certain actions have harmful consequences to the environment or the humanity, and nevertheless persisting in them, is what many individuals lawfully do without getting together.

Of course not: I meant Russian audience, which that poll and the post were about. Added "Russian" into the post, to avoid further misunderstandings.

> every single person I know has and actively uses a VPN

I do know people who use no circumvention methods: some are simply not sufficiently familiar with technologies (including older people, who seem to think that something is wrong with their phones), for others it is a mix of regular shying away from technologies and being worried that it draws the government's attention. And then there are those who appear to genuinely support the censorship (or whatever else the government does). I also hear of people switching to local services as the regular ones are blocked.

Anecdotal data is of little use to determine the extent though, and trustworthy statistical data may be hard to come by, but if you somewhat trust the Levada Center, their polls indicate that YouTube's Russian audience halved following the blocking, among other things. [0]

> WireGuard also works just fine - I was able to selfhost and use it without any extra obfuscation.

For both IPsec and WireGuard, I have both heard of the blocks [1] and observed those myself, particularly to servers across the border (which were otherwise available; there is a chance that I misconfigured something back then, but I recall it working fine with local servers). For IPsec, I have also observed blocks within the country (and RKN lifting those on request, confirming an intentional blocking that way, twice; also confirmed that those were for IPsec packets in particular, not any UDP). But possibly it does not affect all the foreign subnets: as with a recent blackout [2], when quite a few were affected, but not all of them.

[0] https://www.levada.ru/2025/04/24/polzovanie-internetom-sotsi...

[1] One of the recently seen public mentions is at https://blog.nommy.moe/blog/exotic-mesh-vpn/

[2] https://github.com/net4people/bbs/issues/490

> In my experience, Dell and Lenovo have excellent Linux hardware support.

I have tried just one cheap Dell laptop, Vostro 3515, which works mostly fine with Linux (it came with Ubuntu, I have installed Debian), but the touchpad becomes unreponsive sometimes (probably after a sleep), and at some point it refused to charge, which required an UEFI firmware update to fix, which in turn required Windows (I had to use Windows PE) to install, as the direct update (from the UEFI itself) was failing, and there is no Linux option.

Could have been worse, but now considering a Lenovo ThinkPad as a future replacement.

> It Won’t Even Work

I heard similar sentiments about censorship efforts in Russia, but it does seem to work, unfortunately. So far they have outlawed and blocked major VPN providers (and keep blocking more, including non-commercial ones, like Tor bridges, and foreign hosting companies' websites), blocked major detectable protocols used for those (IPsec, WireGuard), made usage of proxying ("VPN") an aggravating circumstance for the newly-introduced crime of searching for "extremist" information. That seems to deter many people already, and once the majority is forced to use the local approved (surveilled, censored) services, it is even easier to introduce whitelists or simply cut international connections (as is already practiced temporarily and locally), at which point the ban is successfully applied to everyone.

> And people who don’t want to share their email can use a temp email service, so it’s no skin off their back.

That seems to be a better option for bots than for actual users: if you care about the account, you probably would not want to make its password resettable via a service like that. Or even via a regular email provider you do not trust, and those could easily be the only kind available.

I think the usual advice is to try the vanilla Emacs, maybe use better-defaults (either directly or just for inspiration), as it is a relatively light customization. The setups people use tend to be quite different, as do their opinions on packages, so I doubt there is a single satisfactory and agreed upon "source of truth". Others' setups may be useful to check out, possibly pages of emacswiki.org, chatter on the #emacs IRC channel at libera.chat.

Edit: As for heavily customized versions (Doom, spacemacs), I have not tried those myself, but occasionally saw people having issues with those, and others not being able to help them, since it was not clear what sort of magic is going on there. So I would not recommend those to new users, at least not if you would like to learn the basics and get a better hang of it, to be able to debug it, though some seem to be happy with those.

The advice looks sensible, but not sure if it does more good than harm. I recall simplified user interfaces standing in the way, hiding (or simply not providing) useful knobs or information/logs. They are annoying both when using them directly as a "power user", and when less tech-savvy users approach you (as they still do with those annoyingly simplified interfaces), asking for help. Then you try to use that simplified interface, it does not work, and there is no practical way to debug or try workarounds, so you end up with an interface that even a power user cannot use. I think generally it is more useful to focus on properly working software, on documentation and informative logs, sufficient flexibility, and maybe then on UI convenience, but still not making advanced controls and verbose information completely inaccessible (as it seems to be in the provided examples).

On the bright side, this will lead to a more relaxed December schedule. I do not compete for the leaderboard, but trying to solve the puzzles on the days they are released (to keep it in the spirit of an advent calendar), and the puzzles towards the end sometimes take me a considerable chunk of the day to solve, which is tricky to combine with the regular schedule, and may be rather stressful (though still a nicer kind of "stressful", as you get on celebrated holidays).

It does that in Firefox at certain window sizes, too, supporting its claim to consistency across major web browsers.

It looks a bit messy to me, neglecting usage of hyperlinks, but at the same time highly legible (does not mess with fonts, colors, or the layout too much), lightweight, works without JS, does not geo-block me or require to solve captchas, not paywalled, not blocked here, is straight to the point. So perhaps still more easily readable than most of the other submissions found on the HN front page.

> Our survey measured it on a scale of how much people agreed with sentences including “Following coronavirus prevention guidelines means you have backed down” and “Continuous coronavirus coverage in the media is a sign we are losing.” Our interpretation is that people who responded positively to these statements would feel they “win” by endorsing misinformation – doing so can show “the enemy” that it will not gain any ground over people’s views.

The actual study is paywalled and not present on Sci-Hub, but I wonder what were all the questions, whether they tried it the other way around (with true claims, perhaps on some other topic), how different the answers were with those. I would guess it is implied, to support such an interpretation, but it is not stated explicitly, and from what is written, it sounds like people who believed in conspiracy theories (or were otherwise skeptical of mainstream views) were in fact unhappy to go along with prevention measures and annoyed by the mainstream coverage, which is not surprising at all.

Well, at least Idris aimed to become practical, and there is the CompCert compiler in Coq (called Rocq now, actually), demonstrating viability of large verified projects. Besides, one does not have to verify everything in those, and could program more or less as in Haskell (which may also seem impractical, but it is used for all sorts of things, and is my primary language these days, for both work and hobby). I think the primary issues with those have to do with their unpopularity, and particularly lack of libraries. Though C libraries are usually just an FFI call away, so even such smaller languages are not that painful if you try to simply get things done in those.

I recall there being at least SDL2 bindings for Idris (not to mention those for Haskell, which also has game libraries), and some linear algebra libraries in those languages (complete with verification), but probably not particularly extensive.

They are not the most practical choice if you do not need verification, but if you would like to use languages like that, they are available and usable, but with additional effort/drawbacks. I wish they were more mature and had a better infrastructure, too, but that would take people pushing them to that point.

Languages with dependent types (Agda, Idris, Coq, Lean) seem even closer to the description, with a user supplying proofs of properties. For instance, as in idris2-algebra [1]. One can similarly define isomorphisms, or other kinds of morphisms, by listing their properties, and requiring proofs to construct.

[1] https://github.com/stefan-hoeck/idris2-algebra

> but what would be the benefit of having more pages fail to render?

I think those benefits are quite similar to having more programs failing to run (due to static and strong typing, other static analysis, and/or elimination of undefined behavior, for instance), or more data failing to be read (due to integrity checks and simply strict parsing): as a user, you get documents closer to valid ones (at least in the rough format), if anything at all, and additionally that discourages developers from shipping a mess. Then parsers (not just those in viewers, but anything that does processing) have a better chance to read and interpret those documents consistently, so even more things work predictably.

It is too annoying to carefully scroll to the small ranges at which texts are visible, with a custom horizontal scroll, to fish out small bits of text, which do not even seem to be written well. And that is after enabling JS, without which it is broken, yet not obviously (not much more than with JS). Websites about design and typography tend to be broken and illegible, but this one seems to stand out even among those.

But as with quite a few of other such websites, disabling CSS actually renders it easily legible and navigable, even without JS.