greengreengrass

> "redefine" a hard question into an easier one they could answer (e.g. ignore the constraints that were key to my question)

> I understand a lot of that came from their desire to create a curated list of questions

I think both of these are true, but I'm not sure that many of the contributors (or even many of the moderators?) _really_ cared too much about building the "curated list of questions".

I'd posit that part of the problem was also its competitiveness – contributors wanted to earn rep, so they ignored constraints or answered the question they really wanted to answer. Some of the tags I used to frequent had a few contributors who seemed to do nothing but answer SO questions, so there were never any good questions left for a mere mortal with other commitments in their day.

I am generally unconvinced that reputation-based systems like SO's are actually useful. Contrast SO with a project mailing list or issue tracker – where I've had some of the best support – where there's nobody tracking rep or keeping a tally, and everyone is there to simply help and share their knowledge.

> Instead of hunting for dups to close, they should have had their moderators link them together and author the "canonical question" from them.

I did plenty of free moderation over time on the review queues. I have no idea today why I invested so much time in that, for it was a thankless task and ultimately didn't feel I could move the needle on the bigger problems.

> promise security and.. make a profit

Some would argue the inherent moral hazard makes these opposing outcomes that cannot be achieved simultaneously.

I’ve self-hosted for 21 years.

I also run mail servers for others, mostly non-profit adjacent groups who don’t have the capital to be extorted by cloud service providers.

Sure, there are some things to learn, but like anything – if you do it properly, it’s not hard and can work properly. Never had any deliverability issues over that time (yes, even to the big providers). I also almost never touch the boxes (I do about one architectural overhaul a decade and am working on the next right now).

If you’re willing to invest the time and resources to do it properly, I agree, it works fine.

> That's just how SSH works

I know that. Just because SSH automatically sends my local $USER doesn't mean they have to report the value received in the SSH username automatically on the game platform to other users, without first having prompted me "your username has been reported as <greengreengrass>. Is it okay to show this?".

A simple flag in my user profile in the platform to say whether I've said that's okay or not.

Or instructions to advise people to choose their username /before/ first connect. These are reasonable, privacy-preserving things to call out in a good and user-friendly design.

I would prefer the connection instructions made clear that the default SSH username would be used to set up my username on the platform and display that to other users without initially seeking my consent. On $machine[work], I don't get to pick that $USER is my full name.

If this affects you, make sure you connect with `ssh [pseudonymous name]@late.sh`.

Umm, just no. "Law" =/= statute.

I see this also purports to link to secondary regulation, but there's a reason lawyers pay huge chunks of cash to professional firms that ingest court decisions and other sources of applicable regulation. Meh, there's a reason _lawyers_ are paid huge chunks of cash to be kept on retainer and give their opinions to begin with.

It's harder to solve some of these problems than prompting an LLM to vibe a solution. I wish we'd stop.

>> Or inspect their SOC2 documents?

> SOC2, ISO27001 and all that shit is not the same thing.

Hard agree. SOC2/ISO27001 are a thing that might be useful, but are mostly a framework dreamt up by auditors and other people who like wearing suits (and making lots of money).

They have some normative controls. But a SOC2 audit is not going to survive contact with an engineer who can push code and whose job depends on the company they work for making money. Where they have to ship product features, and don't have weeks to justify every line of code they write.

A SOC2 audit is not going to survive contact with a script kiddie in their bedroom (or, a nation-state APT) who has plenty of time and an LLM to help them find vulnerabilities or weird edge cases they can compose to attack a system.

These frameworks might serve a purpose, but corporate 'compliance' departments have been lulled into a false sense of security that a satisfactory SOC2 audit means the product is secure and obviates them from asking more technical details or for a fuller audit. It's not. That doesn't matter in a lot of cases, but probably does for a network security solution - I would absolutely be asking deeper questions if I was deploying any of these products en masse.

But then again, the insurers probably asked for a SOC2 certificate, so I guess like most things in life, it's not about whether the systems are secure - it's about whose insurance is ultimately covering the loss.

(not top poster)

> Isn't Headscale server-side only ?

Yes. You're still running the native Tailscale client code on the hosts, which this evidence reveals can't be as trusted as Tailscale would like us to believe.

I also wouldn't trust Headscale fully. It had a critical defect at some point that, IIRC, would allow an attacker to rotate the key of a registered node without auth to a value chosen by the attacker. And its primary maintainer is a member of the Tailscale team, apparently maintained with full approval of their employer and with reasonable transparency between the projects, but nonetheless the overlap is a little close for comfort.

Frankly, as you've said, I don't trust any of these solutions to be anything more than a convenient way to jump onto a bastion or another host of minimal consequence to get into the network and jump onwards.

Exactly this. Most of my time writing code is now not necessarily spent writing the said code, but going through whatever Claude or some other agentic process produced and tidying the comments to be less temporally sensitive to the conversation that produced it.

The problem is that process of not writing the code, but just editing what the LLM produced – and somewhat mindless editing at that (I'm editing comments, not LoC!) – leads to a loss of focus and all the perils of human procrastination that entails (hello, writing comments on HN).

I've tried to prompt Claude et al. not to do this - but whatever I've tried so far, even meta-prompting it to ask why it ignored my instructions, it doesn't work, doesn't stick, and I can't find a good way to stop it.