smashed

I think the desktop client can authenticate to an IdP by opening a browser window and doing a login flow.

If the user is forced to authenticate to start the VPN session, would that make it zero trust?

I think once the VPN is on, it's on, and the remote service cannot get identity info from the network layer.

Seems like what you want to achieve can only be built on the application layer?

Thank you for saying it better than I could.

It's a spectrum and the changes are gradual, but if you zoom out, would you say the current administration is more or less fascist than the previous ones?

The US economy might be booming yes but I was referring to how it relates internationally. The value of the US dollar is on a downward trend. Trump might be pushing Buy America but for the rest of the world, it's Sell America.

That would be destruction of evidence.

A solution that can seem like plausible deniability could be interesting.

I wonder if the US population understands that the entire world now knows the US is under a fascist regime and is cutting ties as fast as possible. The economic repercussions of this regime will be felt for years to come. Look at the USD/EUR or USD/CAD exchange rates over the last year.

edit: thanks for the downvotes. I know political comments are frowned upon on HN and that is fine. I tried to be factual but my tone was probably off.

I've had numerous searches literally give out text from the video and link to the precise part of the video containing the same text.

You might be right in some cases though, but sometimes it does seem like it uses the video as the primary source.

All of these problems have been solved on the web and there are many more websites and user agents in the ecosystem.

Certainly, there are other market forces at play. Certainly carriers refusing changes and refusing to let a 3rd party authority sign their certs.

This subreddit is a great one and if you read the announcement they are taking a very sensitive approach.

HN is obviously very pro-ai and many top-level comments mention that blocking AI submissions will leave r/selfhosted in the digital stone age. That's not at all what they are doing.

The vast majority of vibe-coded apps submitted lately have been simply either very low quality, inferior clones of existing apps, or just incomplete non-sense with a good readme. Redditors are rightfully rejecting that but the trend has been to reject it because it is vibe coded and not for the right reason: the low quality.

In a sense they are protecting ai assisted apps from being lumped in all the crap and auto-rejected by the community.

If you rephrase the announcement as Limiting low-quality/low-effort submissions instead of vibe coded, nobody would object.

I've noticed many posts hitting the hn front page in the last few years trending first on r/selfhosted so there's a good overlap between the communities. Before judging I'd encourage you to take a look. I've discovered many apps I use daily through it (immich, jellyfin, frigate-nvr for examples).

Many countries have deposits for single use bottles/cans but an electronic device with a lipo battery is seen as perfectly fine to throw away.

These things should have 100 times the deposit amount of a can of soda with mandatory requirements for retailers to take the 'empties' back.

Should have used an LLM to proofread.. LLMs can still cannot be trusted?

Feels like it should be fairly easy to instruct an LLM to not rewrite previous entries, unless that's a desired behavior.

Also, why would 2 or 3 versions be documented in the same commit.

But there's a good chance you are right.

In the specific commit, what seems like a bot or automated script added changelog entries for 3 new versions in a single commit, which is odd for an automated script to do. And only the latest version had the date added.

https://github.com/anthropics/claude-code/commit/870624fc158...

That actions-user seem to be mostly maintaining the Changelog but the commits does not seem consistent with an automated script. I see a few cases of rewriting previous change log entries or moving entries from one version to another which any kind of automation would not be doing. Seems like human error and poor testing.

What implementation are you using? Can you easily handle things like authentication and calendar sharing? For example sync a family calendar.

Ostree and immutable distros in general are seeing a renewed interest lately for mostly security reasons but they have been and are still widely used for appliance-type devices.

I could see someone wanting to build an arch based firmware with OTA updates use this as a proof of concept. Yes, they would have to customize it and operate some infra but that does not make it useless.

I haven't seen any LLM tech shine "where every detail matters".

In fact so far, they consistently fail in exactly these scenario, glossing over random important details whenever you double check results in depth.

You might have found models, prompts or workflows that work for you though, I'm interested.

They are an alternative to the tailscale operated DERP servers, which are cloud relays.

Even with the much touted NAT punching capabilities of tailscale, there are numerous instances where tailscale cannot establish a true p2p connection. The last fallback is the quite slow DERP relay and from experience it gets used very often.

If you have a peer in your tailscale network that has a good connection and that maybe you can even expose to the internet with a port forward on your router, you now have this relay setting that you can enable to avoid using the congested/shared DERP servers. So there is not really a new use-case for this. It's the same, just faster.

Officially you are right, they release it as a stable OS after a few weeks of beta's.

Unofficially any serious user knows to stick to LTS for any production environment. This is by far the most common versions I encounter in the wild and on customer deployment from my experience.

In fact I don't think I ever saw someone using a non-LTS version.

Canonical certainly has these stats? Or someone operating update mirror could infer them? I'd be curious what the real world usage of different Ubuntu versions actually are.

In the list you shared, my preference would be https://www.svgrepo.com/svg/50402/linux

Microsoft did port some versions of Windows to Itanium, so they did not reject it at first.

With poor market demand and AMD's success with amd64, Microsoft did not support itanium in vista and later desktop versions which signaled the end of Intel's Itanium.

It uses pgvector extension for search (?) so it's not as easy as changing the db engine. Using the provided docker compose file it's very manageable and the default/recommended layout keeps all data files in a single directory.

Why so harsh?

I'm not advocating in doing it for the exposure as a primary reason. And absolutely not to be paid in exposure. 100% agree with the comic there.

I should not have used that word. It is clearly charged with negativity.

Of course I wish everyone would be compensated for their work. I feel that for some types of project, publishing as open source is a great way for people to find and use it. This can give new opportunities.

Exactly which kind of project and under which conditions is up to debate.

I have worked on a few projects that I regret not being able to open source. Mainly not my choice, stakeholders wanted traditional go to market strategies and failed/ran out of money trying to make sales. I can't help but thinking what other opportunities could have arisen have we chose another strategy.

Keep in mind that they probably use it or at least discovered it explicitly because it's open source. So either you don't release it and they use something else, or you release it and they use it. Option 2 sounds like giving you more exposure and more opportunities in the long run.

It's probably related to this:

https://www.phoronix.com/news/Linux-6.16-QCOM-USB-Audio-OLOA...

Audio usb offloading. Only supported on Qualcomm soc's.

Article is misleading. Audio offloading is probably only useful to avoid waking the main CPU too often, so better battery management... CPU can remain sleeping a few microseconds longer, not all the time.

Not something many will benefit.

Pixel 8a has 8gb ram. It's not a low end number for Android phones.

Probably more the fact that the memory and battery management logic assumes all user apps which are not in focus can be killed aggressively, which makes the system unsuitable for any background task by design.

Not sure they are using l2 transit.

They are using BGP and routing nodes (backbones), recreating a mini IP (layer 3) network I think.

I've used raw wireguard in a p2p fashion to interconnect LANs. I run wireguard on each segment directly inside the network routers.

Just make sure all LANs are using a different subnet. A /24 is standard. Then configure all the peers and you get a fully peer to peer network. No relays. You only need one side of every peer "pair" to be reachable from the internet.

I do have a small management script to help peer discovery (dynamic IPs) and key exchange, but it's not strictly required. With a dozen nodes or so, it's maintainable manually. Wireguard supports roaming natively, as long as one peer can reach the other.

Very little overhead. ICMP, TCP and UDP support.

In an ideal world your code-base is always compatible with the previous migration state.

So new version can work with the previous version's DB schema.

Then, yes, simply run the migration in a transaction once the new code is deployed. Postgres has fully transactional DDL changes which helps.

Of course, it heavily depends on the actual change being made. Some changes will require downtime or must be avoided if it is too heavy on the db.

Another approach if the migration can be applied quickly is to just run the migrations as part of the deployment script. This will cause a downtime but can be short.

Easiest is just to do runmigrations in your docker image start commands, so DB is always migrated when the container starts.

tl;dr: It depends on the complexity of the migrations and your uptime requirements.

This.

I use celery with the same code base/docker image. Just a different entry point to start a celery worker instead of a wsgi (web) worker.

Too many http requests? Add web worker instances.

Background jobs piling up? Add celery workers.

Clearly separate read endpoints from write/transactional endpoints and you can hit a slave postgres db or the master db depending on the http call.

This creates a very robust system that can scale easily from a single code base.

That is very cool, had no idea qmodem was built in Pascal at the time.

Thanks to the author for adding a very interesting readme.

I know this is for archiving and historical value, but I'm wondering what kind of license this work would/could fall under?

I see some files have copyright headers from probably long gone companies (upgrade.pas for example).

Also, the readme mentions the original documentation is not included but the src dir does contain a 98kb .HLP file, which I thought was more associated with early windows era software and not common for MS-DOS but someone might want to take a look

> * Better tooling to determine why it's falling back to DERP instead of direct for remote clients. DERP relays should be an absolute last resort to provide connectivity for Business-plan-level customers (very slow), and the way TS works just assumes any connectivity is fine.

Tailscale touts all the perf benefits of the wireguard protocol but in practice between the userland wireguard that seems to be used all the time on all platform (even linux) and the over reliance on DERP, it has none of the performance benefits of the real thing.

> Byte mode uses (you guessed it!) 8 bits per single character.

8 bits is enough to represent the entire ascii char table, there must be some other limitation going on. QR code control chars maybe?

The linked "byte mode" table only has 45 individual chars. This could be represented with 6 bits with room to spare..