nf-x

Using one for couple of months so far. I need it once a month for a couple of hours or so, but it saves me 3x more time, so money well spent. But wow, at 3x less price tag it a deal!

Oh, does that already integrate with GitHub? Need to check how it deals with layouts and arrows in comparison to Mermaid

By the way, what can you tell about Roon as an active user? It costs as much as Qobuz, but it’s your responsibility to fill up your library and provide infrastructure - which is weird. Sure, it sponsors musicbrainz and lastfm for metadata and puts some nice UI, gets buddies in HiFi manufacturers, but what else?..

I’m very surprised that Roon does UNPnP for own port, potentially exposing home network through some zerodays. For that money it has to do reverse tunneling or something like that.

Local library playback has always been a challenge when the size is in tens of thousands. But after that the main challenge is headless networked playback from separate subnets - e.g. one great stereo system controlled by multiple members of the household from multiple devices

This is one of the best blog longreads I have enjoyed in a while!

to begin with, why not setting validity for 1hr? you don't need to onboard an untrusted tool then.

i wonder when Claude/Codex would start baking it as first-party features

there are so many great tools in the baseline core infrastructure. and there's so much NIH syndrome still.

appreciation and OS aside, systemd-creds relays long-lived creds into long-lived processes, and author's AI slop attempts at short-lived/on-demand injections. Apparently, author's AI slop gets a lot of iterations, but has not much of external scrutiny yet.

keepass is great, because it doesn't require any service to operate - it's just a file. technically, you are responsible for backing it up, but more centralized options possible. I used it for 4 years pre-touchID era in a corporate setting and it worked great. For a single device. UX was very "open source", but hey - it's a free software with other focus in mind.

i know other people partitioning their secrets into multiple keepassx vault files, so the argument about using the same password manager can be interpreted differently.

But the IPC is process-wide, not vault-dependent. And requires touch approval on every access, without “trust this process for X minutes” possibility.

Other 1pass is a great UX. It was even greater before Electron refactor and non-subscription model.

How funny it may sound, but I was recently researching around for these kinds of tools for the same exact purposes.

Where I got stuck was at the Secure Enclave storing biometric-crypted payloads in the keychain, but couldn’t get it to work without Apple Developer subscription for code signing, otherwise these features wouldn’t work. And nobody with an Apple Developer subscription wants to sign someone else’s code, obviously. I really wonder why Apple itself, or any other reputable company, didn’t publish an utility like this already - it’s also a trust issue, when you run code like this.

The issue is that /usr/sbin/security invocations can be obscured to read from keychain, but require password typing every time, which is annoying. And lazy people can just hit “trust” by mistake. And then it’s just another clear text, but more annoying to reach.

Even though, it may be possible to show a touchID prompt in two other scenarios: - encrypting payload with a key stored in the enclave - then it becomes closer to SOPS approach. Age plugin for sops also supports using private keys on yubikey, by the way. But SOPS UX feels clunky. - just calling the APIs to show touchID as part of the application logic, like all modern password managers do. But then you really have to trust the password manager or the tool that does it, because touchID doesn’t equal security in this case.

Some password managers support CLI, SDK, and Terraform providers for working with their secrets, but that requires an IPC enabled, potentially increasing the risk for the other secrets stored in the same password manager.

Oh well, tough choices everywhere.

some of the third-party apps can show if a number is potentially a spam or a business. it's handy when your phone number is listed in the business directory to avoid those annoying calls.

How much of it is written by AI?