metafunctor
Joined 17 years ago
Karma
4,835
Submissions
860
Member since
Jul 21
I’m a software entrepreneur.
View on Hacker NewsRecent submissions
Comment · 2 days ago
I'm switching to Debian for my companies and personal projects.
For 15 years or so, I used and recommended Ubuntu. But this is unacceptable and I won't be looking back.
Comment · 10 months ago
Not impossible at all with a policy-filtering HTTPS proxy. See https://laurikari.github.io/exfilguard/
In this model, hosts don’t need any direct internet connectivity or access to public DNS. All outbound traffic is forced through the proxy, giving you full control over where each host is allowed to connect.
It’s not painless: you must maintain a whitelist of allowed URLs and HTTP methods, distribute a trusted CA certificate, and ensure all software is configured to use the proxy.
Comment · 11 months ago
The key itself appears to have no validity period, the validity period is only for the certificate made for the key. Maybe you could create a CSR for the key/identity and then sign it with your own CA (or self-sign with openssl) for whatever validity period you like. Then `sc_auth import-ctk-certificate`.
Comment · 1 year ago
Good point! The web is going through its own endless September.
And so, it seems, is everything else. Perhaps, this commentary adds no value — just old man yells at cloud stuff.
Comment · 1 year ago
The npm team is, frankly, a bunch of idiots for saying that. It has been obvious for TEN YEARS that the bar for publishing npm packages is far too low. That’s what made npm what it is, but it’s no longer needed. They should put on their big boy pants.
Comment · 1 year ago
Welcome to the web side. Everything’s bonkers. Hard-earned software engineering truths get tossed out, because hey, wtf, I’ll just do some stuff and yippee. Feels like everyone’s stuck at year three of software engineering, and every three years the people get swapped out.
Comment · 1 year ago
I never saw it as a problem for nginx to just serve web content and let certbot handle cert renewals. Whatever happened to doing one thing well and making it composable? Fat tools that try to do everything inevitably suck at some important part.
Comment · 1 year ago
It’s quite easy to run your own DNS server — I've found it a worthwhile exercise. Of course, you’ll need a server to run it on.
Comment · 1 year ago
Those muscle mass percentages cannot be right. How were they measured?
Comment · 2 years ago
Sabre or Sable?
Comment · 2 years ago
I was excited to try this, since I'm a bit tired of selecting the input manually multiple times per day. Unfortunately, connecting AirPods automatically switches the input to them, regardless of the previously selected input device, whether it's an aggregate device or not.
Comment · 2 years ago
OK, so the defusedxml.lxml submodule is deprecated and one should use the other APIs from defusedxml instead. That does not mean that defusedxml in it's entirety would be useless.
Comment · 2 years ago
Do you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?
Comment · 2 years ago
Type safe and unguessable IDs are what I've been using in my projects for the past, oh, 10 years maybe? Inspired by Stripe!
In my databases, I often prefer integer primary keys for performance reasons. On the other hand, I don't want to expose my primary keys because they are easy to guess.
Recently I've been playing with Rust, and ended up publishing a library to encrypt IDs in they way I like:
Comment · 2 years ago
If they can get your sqlite files, what makes you think they wouldn't be able to get the encryption key as well?