mrmattyboy

Hi all,

I've been working on a YAML-based synthetic check tool and wondered about your thoughts :)

The idea is to provide a tool that provides:

* Scalability (agents are run and checks are distributed among the agents)

* Web interface for viewing status and results

* An option to use chrome/firefox based selenium tests, or simple requests library, where possible - allowing JSON health check endpoints to be more quickly checked than full selenium page checks.

* A Terraform provider to deploy checks via application deployments

* A (POC) chrome plugin that will generate the check YAML from the browser

* S3 for storing artifacts (docker-compose using minio)

It uses a postgres database with rabbitmq for scheduling checks.

The UI is very much a work-in-progress (so apologies).

Look forward to hearing any feedback :)

One thing to say to this.. I work at a company and have personally setup quite a few mail servers for mass email sending and warming up IPs.. not fun..

(these are all legitimate interest emails)

I was in a meeting with a couple of people from the team and a QA engineer mentioned that everytime he's done with an email in gmail, he spams it off... _wut_..

Whilst yes, we have been blacklisted a handful of times and, based on spam reports (feedback loops), people do mark emails as spam for completely nonsensical reasons... e.g. users signing up, (getting and using the activation email), using the service and then spamming the activation email.

Edit: I definitely think there's a bell curve for sending your own emails:

* If you have a very small platform (at least in my experience), reputation doesn't mean that much, emails are generally accepted by providers (assuming IPs that you used haven't been previously used for spammy activity), so self-hosting might make some sense (though a third-party probably wouldn't be too expensive if you did want to).

* If you start sending 100s-1000s of emails/day, I guess some third party solution would make sense, since running dedicated IPs/domains and servers just for sending emails might not be beneficial.

* As you go to sending 100K+ emails a day, personally, I think setting up servers starts making more sense

Good luck :D Honestly, it's one of my least favourite applications that I stuck with.. I find it horrendously slow (tried on linux+docker and even windows :P ).

But it looks good, does the job and stability hasn't been _bad_ :)

> ... the refrigerator seem functionally complete to me.

And yet fridges are the first product in the kitchen to receive a 24-inch monitor from Samsung :P :P

> I expected to hate this and walked away thinking it was a pretty ok idea. Good job!

Same here.. Though the services aren't bad, but the decent API made me feel like there's really some love put in.

The main thing that put me off is the two acronyms that I barely hear anymore.. haven't seen lol in a long time and omg has certainly decreased for me, I'd feel awkward using it. Maybe if they had an additional re-branded version that was less 'hip', I'd be up for it :D

On a VM host (using libvirt), I run:

- FreeIPA (LDAP + DNS)

- Keycloak (SAML/OpenIDC provider for FreeIPA)

- Gatekeeper (or the new replacement) (SAML authentication in-front of applications that do not support SAML/OpenIDC

- several OpenVPN servers (Personal access to internal networks + connection to remote VMs)

- Tinc (Site-to-site VPNs)

- Jenkins x 2 (CI) with linux/windows/macos build agents for various projects :)

- Racher clusters (k8s "wrapper")

- Gitlab (source code/ticket tracking/CI)

- phabricator (SCM/ticket tracking) - though it's now deprecated ;(

- cachet (status page)

- mattermost (IM messaging)

- sentry (exception tracking)

- gitea (SCM)

- Drone (CI for gitea)

- matomo (site analytics)

- sonarque (code scanning)

- tracwiki (internal wiki)

- onlyoffice (web-based office suite)

- nextcloud (for onlyoffice storage)

- nexus (package artifact repository)

- squid proxies and apt-cacher for package caching

- pfsense (firewall for internal networks)

- perforce (SCM for larger projects (games etc.))

- recipesage (recipe hosting tool)

- icinga2 (with icinga director) (nagios-based monitoring)

- Custom backup solution, using duplicity for internet tier backups

- phpipam (recording networks and assigned IPs)

- remote docker swarm cluster using glusterfs, MySQL cluster, haproxy, mysqlproxy, bind, consul

- portainer (docker management for remote docker swarm cluster)

- docker registry for local builds and proxy instance for caching remote images.

- syncthing for personal file synchronisation

- wazuh - host security scanning

- snipe-it for asset tracking

- seeddms - document storage (bills, receipts, letters etc.)

- Calibre-web (PDF book viewer)

- various self-build web applications, databases to support applications, reverse proxies for internal hosting (mainly haproxy)

Media PC: - syncthing

- plex

- homeassistant

- samba (for other family members that don't like SSH/rsync ;) )

- couple of game servers

Thanks for this post - there's a bunch of great applications posted that I hadn't heard of that look really interesting to try out! :D

I'm not sure if someone has mentioned this already, but if someone has gone down the path to allow enumeration (username check during signup, which is immediately returned ton the user), I would say this is a strong argument where you could protect yourself against enumeration more easily..

The amount of times a user will likely type their username/password incorrectly is going to be a lot higher than those who attempt to re-signup for an account. Therefore adding additional protection to the signup page (hard rate limiting, bot-protection) then aids to stop this username/email enumeration without the need to be as strict on a login page. This is also compiled with ip-based rate limiting/bot protection that can get very frustrating for users within a corporation that have single public IPs for all their users.

Hah, I did this ages ago in notebook application that I wrote for myself..

Though the amount of times I went a long time between logging in, got the wrong credentials and got scared very quickly when all of my notes had vanished :P

I'd suggest (as a falsehood):

Users always have immediate access to their mailboxes

I imagine lots of people do not have their email account attached to their phone, people maybe on a shared computer (library perhaps) and do not readily have access to the password (if it's randomly generated and stored at home) or their mail provider is blocked where they are (things like Hotmail etc. were blocked whilst I was in education)

I'd say there's lots of services that require you to validate your email address immediately after signing up - even where an email address is not required by the service itself - having a grace period to verify you email in such circumstances is great, but see it very infrequently.

Is the only prerequisite for revoking a certificate is to have the private key?

At least from letsencrypt, it seems you also need the original account cert or by re-validating ownership of the domain

Wow, thank you :) Exactly what I was looking for!! :)

Though the SSL cert for their site appears to have just expired :/ Hopefully this is only temporary

I had the same reaction!... but just tested it and lo and behold it works!

    [user@user ~]# cat > ~/bin/git-test-me <<'EOF'
    #!/bin/bash
    
    echo hi
    EOF
    [user@user ~]# chmod +x ~/bin/git-test-me
    [user@user ~]# git test-me
    hi

<3

<3

Maybe something like o'reilly's 'SSL Complete Guide 2021: HTTP to HTTPS' could bump up their price by $/£5-10 and give the difference to letsencrypt? :)

Debatable whether it's worth posting this comment (but maybe it'll sway like-minded people)..

I went to the page and my 21st century brain ignored everything apart from immediately looking for swag photos and price tag...

Of course, I saw it and was blown away (I only spend £15/$25 on a t-shirt max) and in a split second ruled it out...

But a second went by and I actually realised saw donate button and then the big header about contributions to letsencrypt etc....

If I look back at the (I guess) 6 years of using them.. across maybe 60-80 personal domains across 8-10ish TLDs worth of certs... If letsencrypt hadn't been a thing, I'd have still been paying £50/domain or £150/wildcard root domain cert per year. Realistically, for my own personal projects, they've saved me close to $10K. Ignoring the fact that I don't need to renew tens/multiple-tens of certs a year and the hassle involved with that.

I definitely think I owe this to them and will definitely be buying something and hope others in the same boat do too :)

It's sort of wild to thing of a time now without being able to get a new project up-and-running by just sticking up a DNS entry and 3 seconds later having a valid SSL cert attached :)

Edit: Bought something :D

Completely agree :)

Quick question, if I may...

Of the horrible devs that you can think of, how many of them would reach out and say that they're horrible (or make a post like this) vs how many of them think they're great/superstars? :)

Certainly makes me think of the Dunning-Kruger effect!

haha love it!

Or even, you can have some modules tagged as 'with donation' and it injects terraform into the module, which spins up some infrastructure that runs a distributed part of the site ;)

Everyone that uses a module, pays for it by running a bit of it :P

Hey all, this project is still fairly early on work-in-progress project, but was built to try to provide:

* A simple private Terraform module registry, with some basic search functionality.

* Provide analytics for providing information of 'who' is using which module, including which version of terraform they are using, which version of the module they're using and to which 'environment' they had to deployed to it (i.e. has it just been deployed to a development environment, or in use in a production environment). This makes use of manipulating the 'namespace' of the module (used to identify the calling module) and static terraform authentication keys for identifying the environment that the terraform has been run in.) (https://imgur.com/a/uLRH2oU)

* Usage builder (currently fairly rudimentary), but provides a some-what interactive table of required variables, which can manipulate the generated terraform. (https://imgur.com/a/v8q61uY)

* Pulling terraform modules from git sources and indexing them or uploading zipped modules. An additional API to 'publish' a given version of module can be used (e.g. if an SCM tag hook is setup to automatically index a version and a CI job to 'publish' it once any tests have passed). A 'git provider' can be configured, which determines how the URLs for cloning repositories are generated for a given module.

Are you using the free version?

When I set it up a couple of years ago, it was a hard requirement and looking at their features, it still seems to be the case: https://www.cloudflare.com/plans/#overview (under 'Custom Nameservers')

And, as per (https://support.cloudflare.com/hc/en-us/articles/36001742119... and https://developers.cloudflare.com/dns/zone-setups/partial-se...), they state that 'partial DNS' (i.e. using a CNAME to point to them) is only supported by Business and Enterprise plans.

Some other people asking this question: * https://webmasters.stackexchange.com/questions/43719/is-it-p... * https://stackoverflow.com/questions/18422998/cloudflare-or-i...

When I tested a while back, I couldn't setup a subdomain in cloudflare, it only allowed me to setup the root domain. When I did this and just updated the NS records for the subdomain to point to cloudflare, their validation of the nameserver change never passed (since I only set NS records on the subdomain level).

I'm not trying to argue for arguing sake, just trying to show why I thought/said what I originally said :)

Honestly, if this does now work, or there's a way around it, I'll be really happy as I could switch a couple of subdomains to them :D

Agreed!

Though, just a note that if you use them, you need to use them as your nameservers for your domain (the whole domain) (at least for the free tier)

... maybe doesn't matter for most people, but something that's put me off massively :D

Next stage of interview: Sign this NDA and fix a couple of issues on our backlog and review a couple of PRs :D

I'm not sure it's quite the same as a psychological evaluation ;)

I mean, if you had to work in a team with someone.. this sounds like a good way to see how they'd fit in actually working in team under a pressured situation.

You're not labelling them as this or that, or necessarily checking for 'hidden indications' that they could have some condition you know nothing about, it's just finding people that fit into the culture that you're looking to fill.

I (probably awful) analogy could be, if I go to car boot (garage) sale and find things that are good value (and/or haggle).. I'm not telling the person how much the item's worth, but what price it's worth to me/what I can afford.. I'm not claiming to be a antique evaluator.

(Update: Well, I guess I don't _actually_ know they're doing/not doing, but it's my interpretation)

So what about something like:

* US charity that recycles US-hotel used soap

* The recycled soap is resold in US as a charitable item

* Profits from recycled soap sales are used to help fund/grow 3rd world soap manufacturers, or to help them lower the cost to make it, or subsidise the cost to more available to citizens of their country

I see your point and, I know it seems a little roundabout, but could this solve the issue?

I'd love to see a blog post that says, this is how to setup X (I dunno.. mediawiki, owncloud, whatever).. and then go fully in-depth into _everything_ surrounding it.. security, backups, logging, alerting, monitoring, backup testing/restoration etc.. a blog post that really covers everything for a well-protected 21st century hosted application that won't leave the owner in tears after a year!

There's honestly so many posts that make it look so easy, but without everything else that would normally make it a job position in a company :)

I love promoting self-hosting.. self-host, self-host, self-host!

Having said that, I'd say: Chose your battles wisely...

You can run your hardware in X number of physical locations that you have access to (personal house, family etc.). But that doesn't always suffice for backups, so go with an additional cloud provider for additional backups.

Emails: Do you want to be hit with tonnes of spam traps because you're an unknown IP (any individual doesn't send email emails to 'warm-up' your IP). Do you want to lose emails because your personal server had a power-cut or internet connection drop?

Monitoring: I'd said for small-medium personal setups, to get the level of monitoring, central logging and intrusion detection detection that someone (at least for me) would be comfortable with in the current age, a fair chunk of computing power goes to this. Maybe you'd use an external vendor for monitoring, since your home server monitoring itself won't detect if it goes out.

Instant messaging: For IOS, at least, you need to jump through a bunch of hoops to send notifications to devices - should you use an external service for this?

Honestly, I'm rambling, but.. I absolutely recommend self-hosting everything.. but I think a foreword about the amount of effort that needs to go into setting up services that you rely on a daily basis is (or should be) pretty high.

I.e. if I were wanting to setup a single service for myself that I _heavily_ relied on.. I probably wouldn't do it. If I wanted a bunch of applications.. serving 5 applications from a k8s cluster and some additional work for monitoring, log management, backups and other bits and pieces probably starts making sense.

On another note, for me, hosting things on your own, especially for data/services that you truly care about, sometimes can have a keep-you-up-at-night feeling of "you don't know what you don't know".. what if someone is in my network.. what if there's a vulnerability in the VPN, firewall and X, Y Z that hasn't been patched and someone is on my machine deleting/stealing my data. There's also people at lot more clever than you in the world and plenty of people writing scripts to automatically break into services that require a little more knowledge than you have on the subject (whatever the attack vector maybe).

The peacenotwar module appears to write a file to the user's PC. README includes:

  "This code serves as a non-destructive example of why controlling your node modules is important. It also serves as a non-violent protest against Russia's aggression that threatens the world right now. This module will add a message of peace on your users' desktops, and it will only do it if it does not already exist just to be polite."

Link to peacenotwar: https://github.com/RIAEvangelist/peacenotwar

An of course the issues come in: https://github.com/RIAEvangelist/node-ipc/issues

This is really awesome :D Looked for something like this a while ago and wasn't massively keen on what was already out there...

One feature I immediately tried to find, though (and then searched for a github issue for it and couldn't initially see) was to be able to filter meals by ingredients.

Not necessarily the 'fuzzy' search, but (similar to the include/exclude categories) have a drop-down list of ingredients for ingredient auto-completion and then select to add to a list of items.

And then the same for adding some ingredients that are excluded (e.g. want to do something with flour, but have no eggs)

I completely agree.. it's really interesting to have the limitation and have to work around them.

Personally, I feel I can make a nice of-the-era game on an old console like the gameboy and feel accomplished. Anything simplistic, or rather, games made with a low artistic skill (at least that I try to make) on newer hardware just feels cheap/tacky to me.

Not sure if I'm getting across what I mean, but having 8x8 sprites and limited colour palette means I don't have _as_ much to worry about, so trying to design a semi-alright looking player sprite doesn't take much effort (not that some people don't put in a lot of time and do incredible things with it)