mmh0000

If you need Docker CLI commands, isn't it just easier to use the CLI that you're already on?

Docker is fully self-documented:

    / # docker
  Usage:  docker [OPTIONS] COMMAND
  
  A self-sufficient runtime for containers
  
  Common Commands:
    run         Create and run a new container from an image
    exec        Execute a command in a running container
  
  …SNIP…
  
  / # docker run --help
  Usage:  docker run [OPTIONS] IMAGE [COMMAND] [ARG...]
  
  Create and run a new container from an image
  
  Aliases:
    docker container run, docker run
  
  Options:
        --add-host list                    Add a custom host-to-IP mapping (host:IP)

  …SNIP…

HN Article[1] -> Daily Beast[2] -> icelist[3]

[1] https://vechron.com/2026/01/whistleblower-drops-largest-ever...

[2] https://www.thedailybeast.com/personal-details-of-thousands-...

[3] https://icelist.is/

  > I chose managed services specifically to avoid ops emergencies

The benefit of a managed service isn't that it doesn't go down; though it probably goes down less than something you self-manage, unless you're a full-time SRE with the experience to back it.

The benefit of a managed service is you say: "It's not my problem, I opened a ticket, now I'm going to get lunch, hope it's back up soon."

Then you learn that every modern CPU has a built-in backdoor, a dedicated processor core, running a closed-source operating system, with direct access to the entire system RAM, and network access. [a][b][c][d].

You can not trust any modern hardware.

https://en.wikipedia.org/wiki/Intel_Management_Engine

https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

https://en.wikipedia.org/wiki/ARM_architecture_family#Securi...

https://en.wikipedia.org/wiki/Security_and_privacy_of_iOS

It's weird that when using something like Windows, KDE, or Gnome, I notice a delay between clicking and the thing happening on screen. It's maybe 100ms or so, but after using XFCE for years, there's a notable and, for me, infuriating delay in many modern GUIs.

And it's not my computer; I'm sitting here with 32 cores, 128GiB of RAM, and a somewhat fancy AMD video card.

Anyway, I LOVE XFCE. I don't need a lot of bells and whistles in my DE, I just need it to launch applications, bind some hotkeys, and otherwise stay out of my way.

I'm "protected" by the fact Podman doesn't automatically update the latest image even when using the latest tag.

I was more showing how simple icloudpd is to use.

  ⟩ cat ~/bin/icloud_download
  #!/bin/bash
  mkdir "$(pwd)"/{photos,cookies} 2> /dev/null
  
  if [[ -z "${ICLOUD_USERNAME}" ]]; then
      echo "need env ICLOUD_USERNAME"
      exit 1
  fi
  if [[ -z "${ICLOUD_PASSWORD}" ]]; then
      echo "need env ICLOUD_PASSWORD"
      exit 1
  fi
  
  podman container run -it --rm --name icloud \
      -v $(pwd)/photos:/data \
      -v $(pwd)/cookies:/cookies \
      -e TZ=America/Boise \
      icloudpd/icloudpd:latest \
      icloudpd --directory /data \
      --cookie-directory /cookies \
      --folder-structure {:%Y/%Y-%m-%d} \
      --username "${ICLOUD_USERNAME}" \
      --password "${ICLOUD_PASSWORD}" \
      --size original

For example:

  - Red Hat Identity Management -> FreeIPA  (i.e. Active Directory for Linux)
  - Red Hat Satellite -> The Foreman + Katello
  - Ansible ... Ansible.
  - Red Hat OpenShift -> OKD
  - And more I'm not going to list.

Throw in a bunch of "magic" operators that no one understands, configure complex SDN overlay networks, and use invasive security sidecars. Make Kubernetes extremely customized to your environment. And, surprise, it's extraordinarily difficult to learn and use.

On the other hand, if you practice some basic restraint, Kubernetes is simply a distributed init system. Easy and fast to use. Kubernetes gives you base functionality you'll never get out of Docker Compose. Like, automatic load-balancing between pods, automatic node failover and recovery.

I'd take a simple 3-node k3s cluster over hacked-togther compose files and glue scripts any day. And, in doing that, it makes moving into something like EKS much easier in the future should you need "web scale" (mongo is web scale (sorry)).

And of course we have to include the Wikipedia entry:

https://en.wikipedia.org/wiki/Printer_tracking_dots

  > I wasn't even aware that was possible.

https://code.claude.com/docs/en/settings

And, if you really hate manuals, you can just ask Claude to write the settings for you =D

You CAN set these as env vars in your shell, but I prefer to stick 'em in the Claude settings.json:

  $ cat ~/.claude/settings.json
  {
    "env": {
      "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1",
      "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
    }
  }

https://www.fastmail.help/hc/en-us/articles/1500000279881-Se...

  Android does not support CalDAV or CardDAV, which are used to sync calendars and contacts. However, a workaround is installing a CalDAV or CardDAV sync adapter.

  We have tested and recommend DAVx⁵, which is approximately $5. Once you have added your account in DAVx⁵, you can set up calendars or contacts in the app of your choice, and the changes will sync with Fastmail.

  > The experience on iOS is similarly frustrating.

https://www.fastmail.help/hc/en-us/articles/1500000279941-Se...

You can either use their "Device profile" or do it manually.

It'll do bi-directional sync between Android contacts/calendar and Fastmail (or any other CardDav/CalDav server)

Also available on F-Droid: https://f-droid.org/en/packages/at.bitfire.davdroid/

However, I need to know sh/bash well because they're the tools installed by default; in any "well-established" organization, getting approval to install a new shell will range from "12 to 24 months" to "impossible". And without that, I'm not going to put in the effort to learn a new tool that is only useful some of the time and requires massive context switching.

[1] https://en.wikipedia.org/wiki/ALGOL_68 [2] https://en.wikipedia.org/wiki/Bourne_shell#:~:text=Stephen%2...

Buttttt, this goes back to my original post. DO NOT INSTALL MALWARE.

Because that's my first rule, I don't use apps with ads.

Generally, if I can't do a thing from a standard website, I probably don't need to be doing it. Otherwise, I have nothing against paying for a good app. For example, I LOVE AutoSleep.

  - It's local network only, and while I can VPN home, I don't always want to
  - It has a high maintenance overhead, at least for me. It would block too much, then my wife would complain, and I'd have to spend time figuring out the magic rule that was breaking.
  - It's DNS-level blocking only, which is helpful but doesn't cover nearly as much ground as just uBlock can. 
  - The DNS server has annoying preconfigured caching rules, that, while I can work around, it was just more effort for something I don't want to put more effort into.  

I'm of the opinion that if you're seeing ads on your hardware, which you paid for, your computer is broken. That advertisements are always evil, always wrong, and never morally just. And everything possible should be done to avoid, remove, or deface them.

To that end:

Andriod:

  - Root your damn phone! And install AdAway (https://en.wikipedia.org/wiki/AdAway)
  - Firefox + uBlock
  - Don't install malware/spyware (Arguably, Android is spyware, but custom ROMs fix it.)

  - AdGuard (free, works well, but not perfect, enable the "extra" filters)
  - Don't install malware/spyware (Arguably, iOS is spyware, but Apple thinks you're a simp, so Good Luck.)

  - Seriously, you probably shouldn't be using Windows, but I "get it" sometimes you have to.
  - Don't install malware/spyware
  - https://christitus.com/windows-tool/
  - https://old.reddit.com/r/WindowsLTSC/wiki/index
  - https://windhawk.net/
  - https://github.com/Open-Shell/Open-Shell-Menu
  - https://wpd.app/
  - https://www.oo-software.com/en/shutup10

  - Firefox + uBlock and done.
  - OpenSnitch if you run random executables from the Internet.

  - https://github.com/arkenfox

I assume you know what a network firewall is. Think of SELinux like a "System Call Firewall". SELinux will protect you from many so-called "zero-day" vulnerabilities. It watches every syscall an application makes, looks at its policy, and decides if that syscall should be allowed/denied. It is a good thing.

However, SELinux is really not user-friendly, though it is extremely well documented and learnable. (run `man -k selinux` to see all the man pages) Red Hat also has thorough documentation (https://docs.redhat.com/en/documentation/red_hat_enterprise_...)

Specifically, to your "weird permission issues". That is a "problem" with SELinux; it doesn't surface errors well. The TL;DR is: if you get a "permission denied" error, and you rule out the obvious (i.e., filesystem permissions), then you need to know to blame SELinux and look at the `/var/log/audit/audit.log` file.

That file is technically human readable, but there are tools that make it much easier, such as `ausearch` and `sealert -a`.

---

https://danwalsh.livejournal.com/71122.html

"Now this is a horrible exploit but as you can see SELinux would probably have protected a lot/most of your valuable data on your machine. It would buy you time for you to patch your system."

Generally, I use Linux, so I want to use things on my phone that I can also access from my computer.

- Mail -> Fastmail

- Calendar -> Fastmail

- Maps -> I do use Apple Maps. It is not great, but it generally gets me where I want to go. I refuse to use Google for anything.

- Reminders -> (Reminders app has one job, which it doesn't consistently do...) Fastmail snoozed and scheduled emails

- Music -> The Pirate Bay + foobar2000

- Drive -> Syncthing

- Books -> The Pirate Bay + Onyx (Reader)

- Weather -> Local News Site

For me, the real scary part is the hiding "Audit Evasion" (for those not in the know, here's a link https://www.redhat.com/en/blog/configure-linux-auditing-audi...);

Audit is supposed to be able to track anything and everything that happens on a Linux box. Every login, application, socket, syscall, all of it. The fact that they can bypass it is HUGE. You're not supposed to be able to disable auditd without rebooting the system (when correctly configured). And rebooting the system should* trigger other alarms for the security team.

Security through obscurity is not security [1]

When only l33t underworld h4x0rz know about software flaws, there is very little incentive or ability for regular software developers to find and fix what enables these vulnerabilities. Only through shared knowledge can the world become a better place.

[1] https://en.wikipedia.org/wiki/Security_through_obscurity

It was created to be a place for world leaders to attempt negotiations before blowing each other up.

All that would accomplish is removing potential peace talks. The violence would still occur.

Back in the days before LLMs, I went out of my way to set up the Compose key on Linux, just so I could do cool things like —, ®, ™, and ¹ quickly!

[1] https://www.youtube.com/watch?v=XQVzU_YQ3IQ&t=50s [2]

[2] There are far better videos that show this, but I'm on mobile and not going to find it right now.

But how hard could it be to get a Cat 395 excavator in there? Dig a little trench and bury it.

Sounds like a weekend project to me. Has someone told the telecoms this?