hiciu

the apt thing: author should make himself familiar with https://www.debian.org/doc/manuals/debian-faq/pkg-basics.en.... and --no-install-recommends option. The "debian way" of dealing with the dependencies is different than the "slackware way" the author seems to prefer.

You can configure your debian system to use that option by default using apt.conf. If you switch to aptitude you can even ask why given package was pulled in to be installed, or why given package is in the system (aptitude why package).

About the archlinux thing: that's not archlinux, that is cachyos, please do not confuse these two. The archlinux project even has a note explaining "why" in their code of conduct: https://terms.archlinux.org/docs/code-of-conduct/#arch-linux.... (Also don't use `pacman -Sy package` to install packages, there is big red warning about that on wiki)

Data corruption like that should just not happen. You have your journaled filesystems, you have your raid, zfs pools, and whatnot; all that is worth nothing if your database software can just say "I have encountered an error during write operation and now your data is inconsistent, good luck". This is exactly what journaling / write ahead log / innodb doublewrite buffer should prevent.

There is an article "Crash-only software: More than meets the eye" on lwn.net if you would like to read more about it. The postgres fsync bug is also vaguely related to the same issue, also worth reading.

I would even go as far as say that it never was; Red Hat had their own product called "Red Hat Single Sign On" that was, for some time, based on opensource Keycloak project, but the opensource Keycloak project has existed before RH SSO. And exists now that RH SSO product has been deprecated (retired? Idk what happened).

Red Hat does offer a "Red Hat build of Keycloak" now, and of course Keycloak would not exists in it's current form without Red Hat.

But saying that "Keycloak is a Red Hat product and therefore Red Hat and / or IBM should support it" would be, in my opinion, harmful for the whole opensource movement. If, by being engaged with opensource project, a company risks it's reputation then such company could decide against any engagement, or would engage only if it could keep control of the project / community around it.

In my case, ultimately, paranoia has won. :)

How much do you really trust discord? Or games on steam, or slack, or zoom client?

Flatpak does provide you, out of the box, with a sandbox for whole discord app. Sandbox is built on standard linux stuff like bubblewrap / seccomp / namespaces. This should prevent discord from, for example, accessing anything other than ~/Downloads (rw), ~/Pictures (ro) and so on. Or seeing what other processess are running on my pc. Or snooping in my ~/.ssh.

Some stuff might not work out of box and will require reading app's README or wiki. I imagine stuff like "john is listening to song - artist" would require additional permission or configuration. File sharing could be complicated if, for example, discord could not access my screenshots directory. Webcam, voice and screen sharing work out of box but are protected by "portals" provided by (in my case) KDE.

Discord, for example, does not pollute my /usr or /home. It stays somewhere in /var/lib/flatpak/ and keeps my user files in ~/.var/app/$APPNAME. Steam, Slack, all other "big proprietary apps" also keep their stuff in ~/.var/app/$APPNAME. It's not really a choice for them; flatpak just mounts proper directories in proper places and it works really well.

You can use `nsenter --target $PID --pid --net --mount --ipc` and look around to what kind of access flatpak apps have to your system.

Sorry about preaching, I just like that bit of additional separation from stuff I don't really want to trust or care about.

Now, the process of atom decay that would be registered by a Geiger counter has some interesting properties and that's where the "quantum magic" happens.

(at least, that's my mental model of it; ask an expert, I'm not an expert)

I'll just quote nih.gov:

> Autism is known as a “spectrum” disorder because there is wide variation in the type and severity of symptoms people experience.

and wikipedia:

> Autism is clinically regarded as a spectrum disorder, meaning that it can manifest very differently in each person. For example, some are nonspeaking, while others have proficient spoken language. Because of this, there is wide variation in the support needs of people across the autism spectrum.

and maybe take a look at this list:

https://en.wikipedia.org/wiki/Spectrum_disorder#Types_of_spe...

I understand this is just a figure of speech, but this wording suggests that there are "two ends" of the spectrum and (as I understand it) autistic communities are trying to fight that myth.

https://docs.kernel.org/arm64/acpi_object_usage.html says:

> Microsoft only table, will not be supported.

(I know, it's for arm64, but there seems to be no other docs)

But, you can use your Linux kernel to see what's inside your motherboard. Check /sys/firmware/acpi/tables/WPBT, if you have one.

source: https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...

I wasn't trying to replace built-in note taking app, I think I may have gotten used to it? Honestly at this point I quite like it; it's fast (seriously, there is 0 lag when talking notes), it's capable and it honestly works just fine. I love the UI. I totally understand why you would want to replace it with one note or something like that - I'm just saying that current version works for me :).

I don't trust it yet however - I am using Onyx's sync servers, so my content is backed up without encryption to someone's else servers... Since we are talking about syncing - it also works with syncthing without any special integration; my notes are backed up immediately as pdfs on my other devices.

It is slow, if you think of it as a tablet. There are few options in "app optimizations" menu that allows you to switch between ghosting and page refresh speed.

I'm not sure if you can root it / if the bootloader is unlocked.

I'm using it with different stylus - the one from boox max - it doesn't have that magnetic lock, but it's larger and it feels like stylus tip has lower friction on the display.

So dnsdelegation.io can just request certificate for the domain you've delegated via cname from any CA.

edit: I think the most important part of the talk was an answer to question about why .ssh/authorized_keys won't be possible with this scheme (42:00):

> this is about protecting your data from the system as much as possible, so that when you are not logged in it's really cut off

This looks like, among other things, an ecryptfs replacement.

Have you tried Python's asyncio?

Exactly. I feel like Google is trying to beat me into submission.

> the repeated and increasingly hard tests

I don't mind solving quick captcha, but I'm often asked to solve one after another, repeatedly, just to be told that I missed something and I have to do it again - even if I'm 100% sure that I solved the captchas correctly. It happens every day. This is malicious, abusive behaviour.

Hello,

I'm part of young European startup. We have an easy-to-use app that allows our users to mine some crypto, with little to none technical knowledge required.

As part of our app we are distributing few opensource miners (for example https://github.com/xmrig/xmrig) and antivirus vendors are giving us a hard time because the same miners are often distributed with malware. We are looking for someone who could solve this issue. This could be done by modifying those opensource projects, by working directly with AV companies, or perhaps by some binary obfuscation. It's open for discussion, end goal is to make sure that our users won't have to deal with false positives.

This could be anything from few hours of consultation to few weeks of work.

Please send me an email at hiciu (at) hiciu.org if this looks interesting.

Since linux 4.10 you can attach eBPF programs to the cgroups: https://kernelnewbies.org/Linux_4.10#head-4f00d500db4f8e437a.... This allows you to do a really cool things, mostly firewalls attached to the cgroup and not to the system-wide netfilter stack. Imagine application-specific firewalls.

Systemd uses that to add "simple" packet counting eBPF application to the cgroups: https://github.com/systemd/systemd/commit/1988a9d12015990c14....

(eBPF is the same mechanism that is used with seccomp and filtering which syscalls can application use and which are forbidden - used in for example chromium sandbox on linux or with openssh)

> A giant PID 1 that controls everything

> monolithic systemd

Technically speaking only small portion of systemd is running as pid 1. This has been explained many times: https://news.ycombinator.com/item?id=9515789 and I'm not going to explain this again.

> re-implementing such basics as ntp

Systemd-timesyncd is a minimal ntp client. This is not a replacement for ntp. You are free to use full blown ntpd if you want.

Think of it as a dns resolver inside your libc vs running proper caching dns server. It's the same situation.

> more and more things become part of monolithic systemd

https://www.youtube.com/watch?v=bdmv2FQRHWg :)

I believe you still can break their hosted payment form if you provide your telephone number with leading zero.

  $ dig healthcare.gov +short
  92.123.189.103

  $ dig www.healthcare.gov +short
  www.geodirector.hc.gov.akadns.net.
  bh.georedirector.akadns.net.
  127.0.0.1

  $ wget healthcare.gov -O /dev/null
  --2013-12-11 15:57:05--  http://healthcare.gov/
  Resolving healthcare.gov (healthcare.gov)... 23.8.119.205, 2a02:26f0:59:38e::1ce1, 2a02:26f0:59:396::1ce1
  Connecting to healthcare.gov (healthcare.gov)|23.8.119.205|:80... connected.
  HTTP request sent, awaiting response... 301 Moved Permanently
  Location: https://healthcare.gov/ [following]
  --2013-12-11 15:57:05--  https://healthcare.gov/
  Connecting to healthcare.gov (healthcare.gov)|23.8.119.205|:443... connected.
  HTTP request sent, awaiting response... 301 Moved Permanently
  Location: https://www.healthcare.gov/ [following]
  --2013-12-11 15:57:06--  https://www.healthcare.gov/
  Resolving www.healthcare.gov (www.healthcare.gov)... 127.0.0.1
  Connecting to www.healthcare.gov (www.healthcare.gov)|127.0.0.1|:443... failed: Connection refused.