grepular

I did this in Nov 2021 - https://www.grepular.com/Self_Building_and_Executing_Dockerf...

    #!/usr/bin/env -S bash -c "podman run --rm -w /x -v "\$PWD:/x" \$(podman build -q - < \$0) \${@:1}"

I wouldn't even trust that it had booked the hotel on the correct date, or with my breakfast or room preferences. I'd need to go double check everything it did anyway, so what's the point.

You can sign in to this website. If you do, your password has been sent over clear text. People re-use passwords across sites.

I'm finding it interesting that Exim isn't mentioned once in the article or here, even though it's marketshare is much higher than Postfix's at 55%. Would be nice to have confirmation that Exim isn't affected at least.

A superintelligent AI would be able to imitate a human, getting the answers incorrect in exactly the way needed.

However, I'm not entirely sure what kind of system a superintelligent AI would need to access which would be protected by a captcha.

Your "Quick Compare" table has EnvKey winning on everything and doesn't mention anything about the fact it only does about 10% of what Vault does. The 90% of stuff that Vault does that EnvKey doesn't, gets one sentence in the advantages list and is downplayed in the conclusion.

A fair comparison would point out that EnvKey only does a small but important part of what Vault does, and explain why it does it well. Somebody who didn't know either piece of software, might read your comparison and get the false impression that they had equivalent functionality.

I don't expect you to agree, because that would mean you had to change the page to one which maybe doesn't convert so well.

Your "Comparison with Vault" page is not a fair comparison. It pretends like 90% of Vaults functionality doesn't exist.

Does envkey have a concept like Vaults secret engines? E.g Vault can automatically create temporary service accounts in AWS and GCP on demand. It can also create credentials in dbs like postgres on demand and rotate them. Also, can it be set up as a private CA and sign certs on demand?

Also, the weather is just a lot more predictable in some areas than others.

Suggest upgrading your browsing experience by switching to Firefox with uBlock Origin.

I just set it up. Wasn't that difficult:

1. Added a new postgres db and user 2. Added a new dns name 3. Added a new cert for the new dns name 4. Added a new vhost to nginx to proxy to a new port using the new dns name and cert 5. Added a simple docker-compose to my config 6. Added a snippet to my .well-known/matrix/client

Don't imagine it will take much maintenance. Container will be updated along with the rest of my containers, and the existence of the service doesn't change anything for any existing clients that don't support sliding sync.

Encryption in Matrix is a nightmare. I set up Synapse and pulled half a dozen or so people onto it. We have a few chat rooms. Randomly different users clients are unable to decrypt the messages of other users clients. You click some button about syncing encryption keys, and nothing happens. Then randomly a week later you can start reading each others messages again. shrug This has been going on for years now.

This alone makes Matrix the worse chat platform out there from a users perspective IMO. I invested too much effort in getting things up and running and using it now though, so I'm just hoping that this gets fixed one day, or something better comes along that I can migrate to.

I take it by your lack of response that you're just going to ignore this bug report and leave your users exposed to the privacy issue.

Here's a Youtube video I created of it happening: https://www.youtube.com/watch?v=P30Qi2MSbUQ

I'll be blogging this up unless it's acknowledged and fixed.

I assume that once you've fixed the bug you'll be contacting all of your users to let them know that they've been exposed to this privacy flaw. At least the ones that may have disabled remote content at some point.

Also. Since you used Tutanota as an example. From https://tutanota.com/security

> by default, does not load external content from other servers (pictures and videos in emails). The user can choose to have external content shown with a single click or tap, if they trust the sender.

So there you go. An email company that does not load images by default. Whereas the default setting for Skiff is to load images automatically. So in this respect, Tutanota puts "privacy first" and Skiff doesn't.

I just tested Tutanota and it does not have the same bug that skiff has. I think you must be having trouble understanding what the bug is. In skiff, even if you choose to not load remote images, when you view an email that has remote images, although it doesn't show the images, it does fetch them. I look at my web server logs, and I can see it happen. Emailprivacytester.com also shows it happen. I have tested this several times now.

I do not know what your difficulty is. Perhaps you should pass this on to somebody more technical than yourself at your organisation who can actually understand and diagnose the problem.

> No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default.

If you read back, you'll see I wrote email clients and providers. But I'll note that you have not provided a list of clients or providers with privacy defaults that are worse than yours.

> It does not load the images. That's just patently false disinfo.

It absolutely does. You have no idea how your own product works. I literally showed you a tool where you (or anyone else) can verify this yourself in a few minutes: https://www.emailprivacytester.com - By the way, I am the author of this tool, and your email product is the least privacy preserving email product on the market right now.

Are you joking? I've never even come across an email client or provider that doesn't have options to toggle loading remote images. What mainstream mail providers don't have this option?

The only difference between your option and other providers are:

1. Yours doesn't even work. It still loads the remote images. It just doesn't display them

2. Yours has the wrong default.

Your "block remote content" option is even worse than just forcibly loading remote images and not even having the option in the first place, because it tricks the user into thinking that it will preserve privacy, like it does for other providers, but it does not preserve privacy in your case as it still loads the images.

I don't have a list for you. I would have thought you'd have this data yourself given the business you're in.

> There is no foolproof way to load any remote content without possibly exposing email open information.

Also, this is false. You could download all remote content at time of delivery. That way it would be impossible for a sender to differentiate between an email simply being delivered and one being read.

Even more worrying, I just went into the settings and toggled on "Block remote content" and then sent my self another test through https://www.emailprivacytester.com, and it still triggered a remote content load when I viewed the email.

It's saying that the images were blocked, but that didn't stop them being fetched. Entirely defeating the point of the setting.

My point was that defaults matter, and your default is not privacy preserving. Yet you claim to be a "privacy first" service. There are many email clients which do not download remote content by default. I would argue that they preserve privacy better than Skiff does.

"privacy first"

Yet the web UI downloads remote images by default.

Granted, it hides your IP address by proxying the request. But it still leaks that the message was read. I used https://www.emailprivacytester.com to test this. No image was fetched until I clicked the email to read it.

Sandboxing rust-analyzer is fairly easy. Here's how I did it:

https://www.grepular.com/Sandbox_Rust_Development_with_Rust_...

Well, that's a bit out of date now as I use podman, to get around the sudo issues. But that's the basic idea.

This sounds like a nightmare to me. With petrol, you just pull into a spot. Rare that you even need to queue. Extremely rare to have to queue for more than a few minutes. Once you're in, you're back on your way in a couple of minutes. No conflict.

Having to fight for a charger spot, and potentially queue for 10s of minutes, and then wait tens of minutes for your car to charge, and be ready to leave when you're told to... Nightmare.

Hopefully the situation will improve quickly. If not, my next car will be a plug in hybrid.

shrug I have an M2 Macbook for work and a Thinkpad with Debian for personal use. I much prefer my Thinkpad's pointing stick to the Macbooks touchpad.

Like spending £100k on a car which comes with a squeegee in the glove box instead of windscreen wipers.

Yeah, I got the same email. I am in one group, and that group has one other person in it.

Just use Chat-GPT. The future of moderation. What could go wrong?

More than most in the UK. I pay £45/month with https://www.aa.net.uk/ for a more professional service than you'd get with the big providers. Comes with a /29, a /48, the ability to get real-time tech support from actual techies via IRC. I work from home so need a reliable connection.

I pay Three £7.32/month for 12GB. Because I'm near wifi most of the time, I only actually use about 1GB of it per month