Dedime

A common PowerShell complaint, personally I find PowerShell usually takes less keystrokes because the tab completion is flawless.

Yeah, at airports (where most travellers arrive). I recently arrived at Narita airport, you go down to the trains and there's an office you go to where a human being spends a couple minutes helping you get a Suica. It's great because you can also ask any questions you have about usage at the same time.

PREACH!

I run K8s at home. I used to do docker-compose - and I'd still recommend that to most people - but even for my 1 little NUC with 4vcpu / 16Gi Homelab, I still love deploying with K8s. It's genuinely simpler for me.

If anyone's looking for inspiration, my setup:

* ArgoCD pointed to my GitLab repos

* GitLab repos contain Helm charts

* Most of the Helm charts contain open-source charts as subcharts, with versions set like (e.g.) `version: ~0` - meaning I automatically receive updates for all major version until `1`

* Updating my apps usually consists of logging into the UI, reviewing the infrastructure and image tag updates, and manually clicking sync. I do this once every few months

My next little side project: Autoscaling into the cloud (via a secure WireGuard tunnel) when I want to expand past my current hardware limitations

The brilliance of the implementation of cooldowns: For someone to go download and run it, automated or otherwise, they simply follow the standard installation process.

Users who want take the extra precaution of waiting an additional period of time must decide to manually configure this with their tooling.

This practice has been a thing in the sysadmin community for years and years - most sysadmins know that you never install Windows updates on the day they release.

Having a step before publication means that's it's essentially opt-in pre-release software, and that comes with baggage - I have zero doubts that many entities who download packages to scan for malware explicitly exclude pre-release software, or don't discover it at all until it's released through normal channels.

Total meh from me, an end user. User of KeePass since at least 2015, I've written end-user guides, contributed to the main documentation, evangelize it to my family and friends when they have security questions.

I store every single important piece of info in my KeePass database. It stores ALL of my passwords, my SSN, credit cards, my health information, even some weird stuff like my vehicle maintainence records and whatnot. My KDBX file currently sits at 466K. Size is not a particularly compelling reason. Hate to be that guy, but if your database is much larger than that - you're probably doing it wrong.

Newer features like TOTP and passkeys are likewise not a concern for me. What did KeePassXC do when TOTP came around? They stored the relevant data in the attributes, and added a UI around it. It even works with my Steam TOTP, which is a nonstandard implementation. I haven't looked into it, but I imagine they did the same thing with passkeys. I don't see why this couldn't continue to be the paradigm they use. I don't use attributes at all - I haven't needed to, the notes section work great - but I do appreciate being able to look into the "raw data" of attributes quite easily, from within the UI.

If KeePass were being developed from scratch today, or if the developers of the various projects collectively really, really want to switch to a SQLite system of their own volition. Then sure, SQLite. I'm not going to ask them to do that now though.

---

On a separate note, an unfufilled niche that I have though, if anyone's looking for ideas. My secure password storage is a solved problem, KeePass is cross platform, easy to use, and very secure. What remains a problem is secure notes. I want to be able to write markdown (`.md`) documents, add photos and PDFs, then save it to a secure, encrypted folder somewhere. Doesn't need the same security posture as KeePass, but I don't want to leak metadata like file names.

Obsidian - my current notes app - is good from a usability standpoint, but it's not exactly secure. I could pair it up with Veracrypt, but that's a pain from a usability standpoint, and I don't trust my OS to keep the mounted Veracrypt volume contents a secret. Whatever the solution is, it must have a GPL license, or else I'm not going to trust it - from a long-term viability standpoint more than anything else.

If anyone has any suggestions here, would love to hear them.

Hot take alert! As an avid self-hoster, I'd like to hear why.

Personally, I self host because the benefits I receive simply aren't available anywhere else at the level of quality I've come to expect - Jellyfin is a great media player, it's free, and I don't want to switch. Pihole provides ad protection and privacy for my whole home network. It's also free. Homeassistant is amazing, and free. Etc etc.

Well, it's stored in an encrypted way - in the encrypted password database. Much like a password, everyone already knows not to share a passkey. But also like a password, as the owner, sometimes I want to look at it!

My problem with NixOS is the second you try to go "outside the guardrails", the difficulty increases 100x

Admittedly I didn't dive much into this to get the full context, but it's saddening to me that a legendary game designer had a GoFundMe. I was hoping achieving that level of status in a traditionally well-paid industry would leave one well off, financially.

I wouldn't say it's perfect quite yet. I just installed Debian on my Framework, and my microphone isn't working. Debugging it for the last 30 minutes has gotten me nowhere, and half the answers on the internet don't apply to my distro. Until basic issues like this go away or have easy solutions, it's hard to recommend it to anyone.

Maybe this is naive, but in a good crypto system, I would hope "when" is measured in millions or billions of years given current hardware capabilities.

I'll add my opinion as a DevOps engineer, not a startup, so take it with a grain of salt.

* Kubernetes is great for a lot of things, and I think there's many use cases for it where it's the best option bar none

* Particularly once you start piling on requirements - we need logging, we need metrics, we need rolling redeployments, we need HTTPS, we need a reverse proxy, we need a load balancer, we need healthchecks. Many (not all!) of these things are what mature services want, and k8s provides a standardized way to handle them.

* K8s IS complex. I won't lie. You need someone who understands it. But I do enjoy it, and I think others do too.

* The next best alternative in my opinion (if you don't want vendor lock in) is docker-compose. It's easy to deploy locally or on a server

* If you use docker-compose, but you find yourself wanting more, migrating to k8s should be straightforward

So to answer your questions, I think you can adopt k8s whenever you feel like it, assuming you have the expertise and are willing to dedicate time to maintaining it. I use it in my home network with a 1 node "cluster". The biggest pitfalls are all related to vendor lock in - managed Redis, Azure Key Vault. Hyper specific config related to your managed k8s provider that might be tough to untangle. At the same time, you can just as easily start small with docker-compose and scale up later as needed.

From someone who was recently tasked with "add service mesh" - make service mesh obsolete. I don't want to install a service mesh. mTLS or some other from of encryption between pods should just happen automatically. I don't want some janky ass sidecar being injected into my pod definition ala linkerd, and now I've got people complaining that cilium's god mode is too permissive. Just have something built-in, please.

People keep talking about having been hacked, but it's honestly baffling to me.

I'm 28. I started using computers on a regular basis when I was ~9 years old, playing RuneScape. Since then, I've spend probably 10s of thousands of hours on the internet - downloading torrents, signing up for sketchy Russian websites, doing online banking, testing experimental software downloaded over HTTP from a .xyz domain. I graduated high school, went to a technical college for compsci, graduated, worked in helpdesk, desktop support, IT management, and more recently DevOps. I develop software using all sorts of package managers, and used hundreds of thousands of unvetted software packages that arrived as dependencies.

Not once have I, or anyone I've been responsible for, been hacked. No crypto, no viruses, nothing. What the heck are you guys doing getting your Android phones hacked???? Like I only use a modicum of common sense these days, but I guess I've just been lucky and have been the odd one out. I still enjoy reading HN arrivals about security though, so maybe I just have always been slightly more security conscience?

In any case, this is just a stream of consciousness / gut feeling comment. Don't put too much weight into it, I haven't.

Aside from the point made by author - I visited Japan last year, I never had too much of an issue with garbage when visiting the major cities.

Most garbage was compactible and clean enough that I could stuff it into my garbage pocket (to the dismay of my girlfriend). Larger or dirtier items, I would put into a ziplock bag in my backpack that I carried with me everywhere. Public trash receptacles, while rarer than in North America, could be found often enough if you were observant of your surroundings.