lathiat

I also love gron, if nothing else to find the paths I need to use with jq later.

But ChatGPT has genuinely solved my suffering writing jq, it does a pretty good job. It even almost replaces gron, if you feed it an exmaple json and ask for jq, it gives you something. It usually needs a little adjusting but it gets me 90% of the way there and saves me a bit of time.

I rarely use it for much else but its a jq winner :)

Seems like a bit of a combination of "sar" (sysstat) and pt-stalk - a percona-toolkit tool originally designed for MySQL DBAs that would let you wait until a certain system or MySQL condition happened (high cpu, disk I/O, connections maxed out, etc) and then start collecting lots of system and MySQL stats. Rather than having to do them all the time.

Plus a nice TUI :)

On the one hand there is 100% validity to what you say. On the other, people download entire trees of dependencies from pypi, npm, homebrew, independent non sandboxed apps, chrome extensions, etc.

So don’t lull yourself into thinking the supply chain on everything on your system is any better :) It’s likely substantially worse.

Also impressive is that is smaller than every other release artifact: https://github.com/audacity/audacity/releases

In an era where Disney is also increasingly not making physical media available, some of these shows now have literally no legal copies. As the Disney+ streaming service was the only place some of these shows were ever available.

Disney is no longer releasing any bluray or other physical media in Australia and other markets are sure to follow suit: https://thedigitalbits.com/columns/my-two-cents/072523-1400

Its hard not to see this as a media long game, similar to software licenses, you'll have no possible way to own anything. That also seems to open up possible stronger enforcement on pirated copies of movies from streaming services since there is no legitimate way anyone could have had such a copy.

Both topics also discussed on the Linus Tech Tips "WAN Show" podcast this week: https://www.youtube.com/watch?v=8VIeSXvzyIE "Disneys' Ruining Movies"

You may enjoy this guy: Cathode Ray Dude [CRD] https://youtube.com/@CathodeRayDude?si=xSx8uUsUoMSraz-H

These two are better known: LGR Technology Connections

It’s due to what is effectively a network file system. You have the same issue with nfs, 9pfs, parallels prl_fs, etc. It has to stat every file in the repo and that gets expensive on ang RPC protocol. Even local ones apparently.

This is made worse because git uses the os-specific file statistics including inode number to track file changes. These change over most such file systems types which triggers it to rebuild the entire file cache every time you switch OS running git commands. Which if you have shell integration is constantly.

I share my git repos between MacOS and a Linux volume and it hurts on any repo with 100s of thousands of files or more. Ceph, Linux kernel, etc.

Population decline. Which in itself may not be a problem but has all sorts of interesting economical consequences.

You get an aging population requiring care, with less people to both physically and financially/economically fund them.

You also move from always having to build new houses and infrastructure to suddenly having excess housing and infrastructure that isn't needed. Not only does that eliminate a whole bunch of jobs and related economic activity but also drives prices down, etc.

I am sure this is an absolutely terrible summary but you can google population bomb, population decline, etc, for much more informed takes. But basically for the last 100 years the entire world and economy has run on an ever-inflating path and that could change at both a country and world level.

There’s a couple good bash libraries for that too: https://github.com/glamp/bashplotlib

There’s a better one google is failing me on

This has varied over time depending on kernel implementations, CPU core count, number of threads, etc.

Some relevant reading: https://matklad.github.io/2020/01/04/mutexes-are-faster-than...

Yep, I have 37 flagged. Almost entirely accidental. And I have caught and undone many more. Very few in 2022, 2023 though. Mostly before that. Though I think I read HN on my phone much less than I used to, likely why.

Doing it at Defcon is a show. The point isn't really to actually collect passwords there, it's to demonstrate what's possible in the rest of the world, where people absolutely will.

This is generally not nearly as true as people think.

At least according to the EFF: https://www.eff.org/deeplinks/2013/11/trademark-law-does-not...

> The circumstances under which a company could actually lose a trademark—such as abandonment and genericide—are quite limited. Genericide occurs when a trademark becomes the standard term for a type of good (‘zipper’ and ‘escalator’ being two famous examples). This is very rare and would not be a problem for Canonical unless people start saying “Ubuntu” simply to mean “operating system.” Courts also set a very high bar to show abandonment (usually years of total non-use). Importantly, failure to enforce a mark against every potential infringer does not show abandonment.

Have you tried “watch”? It buffers and doesn’t flicker for me.

Thanks for the corrective note. I watched it when it first came out and so missed that context :-)

Also the subject of a recent “Half As Interesting”: https://youtube.com/watch?v=_d6bGAw5yt8

I have always thought the division is to basically protect Apple's cut of the revenue for "App Sales". Not, strictly speaking, because they want to take 30% of every possible purchase or service -- though I am sure they would be happy with that and do desire that to some extent. However more and more every year sales of an "app" become smaller and smaller and everything is a subscription - so it seems this thought is rapidly if not already outdated.

The world we now live in is that all "apps and programs" can be either a one-off purchase like a physical good or a subscription. That subscription might be for the "app" or it may be packaged as a subscription to a "service" that the app is facilitating (the line between the two is very blurry). Additionally, all digital goods like books, music and movies may also be a one-off purchase or a "subscription" like audible, apple music, etc.

The line between all of those is blurry such that, any set of rules you write leaves it open to convert "app sales" to "services/subscriptions" or even to bundle access to your app or it's content as "digital goods" to avoid that 30% cut. People would (and do) switch their sales model to then avoid that cut.

I don't have a solution and I don't think Apple or the open webs way is specifically better in every aspect, but I do think it's interesting to think about the problem space.

I agree the Kindle part was silly, and could be much improved. I just wanted to specifically clarify why you started out on the wrong foot with iOS and why the iOS app couldn't even tell you about the option existing elsewhere.

However once you started on a browser, the rest of your story I would agree with.

The reason is that Apple specifically requires all digital only purchases to only use in-app payment and must give Apple 30%. You are not allowed to process digital purchases through an app with your own payment system. You also can’t tell people that or link them to the website.

This does not apply to physical goods. Which is why all the apps you mentioned are fine.

This is the same issue that has been talked about for years, the cause of Epic (Fortnite) vs Apple, etc.

You sound about the same era as me. I'm 35 now, have been using Linux since 2001 until now. Just remember, that when you started using Linux, it was about 10 years old. It's now been 20 years since then - double the time has passed since you started, compared to what came before it. Some stuff is going to change. Sure some of those commands come from older Unixes but the point still stands :)

Some of your complaints are practical but 2 specific ones I'd note: "ip" has been the tool you wanted to use since even the mid 2000s - ifconfig wouldn't even show you every IP on an interface since then unless it had an alias. Something that may help you make the transition is the "-brief" (-br for short) switch which gives a very compact simple output that is a little easier to visually parse. If you're using a systemd-networkd system, "networkctl status" is also handy.

For systemd, I have never been bitter about it, but while it has changed many commands and interfaces or ways you work, if you just dig a tiny bit below the surface it has SO many modernsations and conveniences that more than make up for it. Make your own rosetta stone for your top commands, but then look around at all the other things systemctl, etc, offer and find some pluses to make the pain worth it :)

See also: https://github.com/certsimple/rosetta-stone

I would strongly recommend signing up for either Backblaze, or using something like iCloud Photos or Google Photos.

My entire 100,000 photos, 20 year library is now in iCloud photos. It's constantly synced and backed up to icloud. Then I have it pulled down in full to a mac that then backs up to backblaze.

Lots of ways to do it, but thats one. :)

For $5-10/month you can get unlimited backup from a machine with Backblaze including your external drives.

That depends on your threat model.

Securing a removed/stolen (or failed) drive is achieved by this method. Securing the entire device from theft is not achieved.

An equally if not more likely threat for many is losing or forgetting the encryption key and losing all your data.

All of these scenarios should be clearly spelled out and noted.

Storage is one of the worst for losing keys it stays powered on for months or years without a reboot. Then you suddenly realise you lost the key. Or the person that had it left.

Tangentially related is this tool for tuning the ECU in Cars. It helps you locate patterns in ECU rom dumps that are likely to be tables. Often they are sets of numbers in a 2D or 3D matrix of some dimension that have smooth increases. Partly it does this by showing you the values visually so you can spot them.

https://www.evc.de/en/product/ols/software/

What is it pinging? The README would ideally explain what it pings and also the brackets above.

I live in Australia. 100-300ms is normal for me unless the thing is also hosted in Australia. So that matters :)

Relevant: https://www.esa.int/Enabling_Support/Preparing_for_the_Futur...

It means malware can’t exfiltrate the SSH key from your machine and keep using it. But yes they can potentially use it while still on your machine depending on if presence confirmation or re-inputting a credential is required. But that still closes a big gap.

On a Mac secretive can also pop a notification making it more likely to passively observe such usage (not fool proof though) and the key can’t (easily, maybe with some complex exploit) be used from an app not signed by the original developer. It can also require re input of your password. That specific security probably isn’t possible on Linux though.

This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey using yubikey-agent (https://github.com/FiloSottile/yubikey-agent; there are too many complicated ways to use SSH keys with a yubikey this is one of the friendliest ones). Depending on the security and frequency of which I access the service impacts whether I need presence confirmation or use secretive versus the yubikey.

I would be remiss to mention there are existing SSH TPM projects, not sure how this one differentiates. It seems to at least have the user experience pretty simple, similar to yubikey-agent (and secretive), and unlike some of the existing solutions which have quite a few extra steps:

https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc...

I really love it when projects like this address there are "competitors" or other software in the space and provide a fair comparison. It would be great to see one of those here :) For example you can easily use SSH FIDO keys but they aren't supported by all server sides, ECDSA keys often are (though not always!) etc :)

Whether or not it's sensible is not quite the point. It's surprising and noteworthy to understand. And by understanding helps understand the internals of this aspect of linux networking.

I ran into exactly this problem a few months ago. But it was a lab scenario rather than a real production one.

In my lab at work I had only a single VLAN (and couldn't get a new one added fast enough for the tight 2 day timeline of the case I was working on, though I have since done so). So I had "MAAS" (Metal As a Service) which PXE boot installs the servers plus OpenStack Virtual Machines connected to the same VLAN. Both run a DHCP service.

MAAS (using ISC DHCP Server currently) responds to any DHCP requests while OpenStack only responds to IP/MAC combinations it knows from it's configuration database and ignores others. So OpenStack wasn't impacting MAAS but sometimes MAAS was responding faster than OpenStack giving the wrong IP to VMs. As a temporary workaround I (tried) to add a firewall rule to the MAAS server to block DHCP from the specific MAC addresses of the test VMs but it didn't work.

Investigating that is when I learnt about this surprise behaviour, which was particularly surprising as I am far more knowledgable than average of many aspects of linux networking including some (but by no means extensive) kernel/netfilter internals and can write most iptables rules in my sleep from memory... despite all of that, this one was new to me :)

(As a side note, when using ovn/ovs networking, Openstack will filter external DHCP requests to VMs, which also solves this, but in this case I was specifically testing SR-IOV where the VMs are directly attached to a virtual function on the physical network card, where such filtering is not configured and may or may not be possible depending on the card)

Right: https://wiki.nftables.org/wiki-nftables/index.php/Nftables_f...

"The netdev family is different from the others in that it is used to create base chains attached to a single network interface. Such base chains see all network traffic on the specified interface, with no assumptions about L2 or L3 protocols. Therefore you can filter ARP traffic from here. There is no legacy x_tables equivalent to the netdev family."

From Wikipedia, while the concept has been discussed since at least 1914 the actual term cisgender has apparently only been used since 1994: https://en.wikipedia.org/wiki/Cisgender