I’ve been thinking about AI and autonomous agents.
These days this is enough to stop me reading, but thanks for saying out that the article is about AI in the first sentence and spare me a click (declaring that in the title would be even better, but first sentence is pretty darn good).
Synchthing if I want local copies, otherwise I just mount sshfs shares from my nas (using sftpman as a helper)
you will have to spend a lot of time learning the Nix language
I'd say you shouldn't use any system (be it nixos, ansible or even bash scripts) if you are not willing to learn it.
That said, I too find pre-made modules less useful that I initially thought when I got into nixos: unless you want to do very basic stuff, a lot of times it's easier to just generate whatever scripts/configuration files you need directly (using one of the trivial builders in lib or writing a custom derivation) rather than learning how the corresponding nixos module works.
One could say nixos modules make easy things slightly easier, and hard things much harder (this is adapted - possibly imprecisely - from a quote on ORMs, I think by Joel Spolsky).
In your shoes (and, in fact, in mine) I'd try to move away from interactive tools and into file-driven ones.
Personally I use nixos, run WUD (what's up docker) to be notified of available updates, and manually test/update the containers once in a while (every couple weeks or so?)
There are a bazillion other solutions (from stuff like ansible/chef/puppet, to docker-compose, to kubernetes, to... a hand-written bash script) - the idea is to setup stuff via files that you can version, reference and write comments in rather than using some gui for interactive steps that you'll forget to document in some wiki.
Monitoring is a whole different beast than configuring: you'll be probably better off using something that does just that instead of some all-in-one solution. Try looking into something like beszel before going for the full prometheus/graphana stack.
domain-driven design (or development?)
I'm not 100% what it is (I'm really not into nomenclature), but I think it's the practice of modeling your software after the domain you are working in... IDK if/how it differs from what everyone has always been doing since forever.
It's how URLs work: nothing flake specific
Does https://www.olivetin.app/ look like what you have in mind?
(OT) what did you use to annotate the picture?
For the technologies/standards (CORS, websockets, cookies, etc.) I'd recommend reading the wikipedia article and then the relevant RFC/standard (which will surely be linked from wikipedia).
The server side things you mentioned (sessions, rendering, etc) are functionalities/techniques/patterns that different frameworks implement in different ways, so I'm not sure there's much material that talk about them in general (or much to say about them in general)... you'll probably have to explore them in deep with your framework/s of choice (ie. looking at how the framework implements that functionality rather than just using it).
Some alternative self-hosting options (besides full-fledged "forges"):
If you don't need issues and stuff, you could just use git and back it up (by copying or cloning/updating to some other machine).
You could deploy soft-serve, which is a self-contained git/ssh server with cool cli (beware: it's not super performant on large repos, so don't host a clone of the linux kernel on it). Since you'll use it via ssh, you don't have to bother with https, certificates, reverse proxies and stuff.
If you are willing to put some effort into it, the (imho) coolest option would be to use radicle, which is a p2p forge (beware: documentation is not great, and - even if the "core" is solid - the cli tools are very much beta still).
My guess they are not even gonna challenge the "clean room" rewrite legally: the damage is done and it's not really gonna be mitigated if they manage to take down the rewrite.
Anthropic pulled the npm package within hours and issued a statement: the exposure was "a release packaging issue caused by human error, not a security breach."
I'm sure they chose the words "human error" to also imply the error is not to blame on their LLM, which remains an open question after reading the article (and likely will forever, although at the very least it would seem like the LLM did not detect this mistake).
License: Oracle Technical Network License (proprietary)
No, thanks
Permanently Deleted
Look into https://www.scuttlebutt.nz/
I've not looked into it much yet, but https://radicle.xyz/ seems interesting.
It's kinda a bittorrent-powerd codeberg and it looks like it's worth playing around with (even though it might not get you rid of much bandwidth... IDK how popular it is, but source usually doesn't weigh that much).
What does "powerful" distro mean? (no, I've not watched the video - just curious what it means)
Getting the router to actually assign an IP address to the server
You would typically want to use static ip addresses for servers (because if you use DHCP the IP is gonna change sooner or later, and it's gonna be a pain in the butt).
IIRC dnsmasq is configured to assign IPs from .100 upwards (unless you changed that), so you can use any of the IPs up to .99 without issue (you can also assign a DNS name to the IP, of course).
all requests’ IP addresses are set to the router’s IP address (192.168.3.1), so I am unable to use proper rate limiting and especially fail2ban.
Sounds like you are using masquerade and need DNAT instead. No idea how to configure that in openwrt - sorry.
I’m not a dev of one of those tools but I know several maintainers and developers that’s why I’m a bit sensitive there!
I get it and I appreciate your sentiment.
I also understand that you are not accusing me of disrespect towards FOSS devs, but let me nonetheless stress that "dumb implementation decision" is not the same as "dumb developer", and that open/frank discussion is as important for the FOSS ecosystem as the effort put in by devs (meaning both are essential, and that is without subtracting from the fact that developing things takes much more effort than talking about them).
I’m not aware of a mechanism to read (unencrypted or not) files on a host without a preceding incident. How else could your files be acessed? I don’t understand how I might have this backwards.
That's not how you should approach security! :)
You should not think of security in the all-or-nothing terms of avoiding your system getting breached.
You should think of it in terms of reducing the probability of a breach happening in a given time frame, and minimizing the damage caused by such a breach.
The question to ask is "what measures will minimize the sum total of
<cost of security>
plus<damage from breaches>
?" and the philosophy to adopt is defense in deep. (*).Fortifying a perimeter and assuming everything is safe inside it is the kind of approach that leads to hyper-secured and virus-ridden corporate LANs (if applied to contrasting drug trafficking, would lead to a country where the only anti-drug measures were border checks).
(*) note that a breach doesn't need to be an hacker breaking in your computer or a thug pointing a gun at your head, it can be just you losing a USB key where you backed up some of your files, or you me leaving my PC unlocked because I have to hurry to the hospital
PS: this might be my anti-corporate bias speaking, but I'd say the reason the "safe perimeter" idea is so widespread is that tools that promise to magically make everything secure are much easier to sell than education and good practices.
Cybersecurity works inherently with risk scenarios. Your comparison is flawed because you state that there is an absolute security hygiene standard.
First of all it's risk analysis :) On top of identifying threats (which I assume is what you mean by "scenarios"), one must assess the likelyhood of those threats and what potential impact they have.
Risk analysis, however is not the core of cybersecurity: that's just the part security consultants are tasked with (and, consequently, the part pros talk more about, and newbies fill their mouths with).
The core of cybersecurity (and of security in general) is striking a balance between cost and benefit, which is an inherently an executive decision (you'll hear "between usability and security" - that's just what people say when they want to downplay "cost" to push others to move towards "security").
That is exactly like managing your health. You I could get a comprehensive health checkup every couple months: that would possibly catch a cancer in its early stages (here's your "risk scenario") and wouldn't have serious health repercussions, but I don't because it's not worth the money/time/hassle (cost-benefit analysis).
Exactly like one does with health, there are security measures you adopt just because you are sure they have a benefit (just that it exists) their cost is very reasonable (ie. low in absolute terms and specifically compared to how much a full risk analysis would cost): did you do a full risk analysis before deciding your PC should have a password? Before setting up a screensaver that locks your screen?
There are two common ways to implement token management. The most common one I am aware of is actually the text based one.
Yeah, the two I've my OP seems to point
Even a lot of cloud services save passwords as environment variables after a vault got unlocked via IAM.
Environment variables have their attack surface, which is way smaller than that of a text file stored in your home directory.
That’s because the risk assessment is: If a perpetrator has access to these files the whole system is already corrupted - any encryption that gets decrypted locally is therefore also compromised.
I'm not sure what "the whole system" refers to in "If a perpetrator has access to these files the whole system is already corrupted".
If the system is my PC, then the reasoning is backwards: the secrets get compromised if (they are not secured and) my PC is breached, not the other way round. On top of that, while basically a lot of breaches may expose the files in your home directory (say, a website gaining read access through your browser, or you accidentally starting a badly written/configured webserver, or you disposing of your old drive, or your PC being stolen, or... many others), a lot fewer compromise properly kept secrets (say, password-protected ssh keys).
If the system is my Codeberg account, then that's the whole reason I should secure my secrets. (Admittedly, neither of these make much sense, but I don't know what else the system could be).
Besides that, I must say "who cares? we're fucked anyway" is quite the lazy threat assessment :D
The second approach is to implement the OS level secret manager and what you’re implicitly asking for from my understanding.
There are a lots of secrets management tools that have little to do with the OS (I'd even say most of them are): bitwarden and all other password managers, ssh keys and ssh-agent, sops, etc.
While I agree that this would be the “cleaner” solution it’s also destroying cross platform compatibility or increasing maintenance load linear to the amount of platforms used, with a huge jump for the second one: I now need a test pipeline with an OS different than what I’m using.
I don't get the point... It would seem you are trying to tell me that secure tools are impossible to build (when you yourself have talked of "vaults that get unlocked via IAM") or that I should just use insecure tools (which... is my own decision to make)?
If you took offense because I called those forjego CLIs "dumb" I do apologize (are you the dev of one of those?).
I clicked on them all so you don't have to (well, so you can better decide what to investigate and what to ignore):
Ratty 3D TerminalIs the compiz of terminal emulatorshttps://ratty-term.org/
TheyLive AdblockerAn ublock origin lite fork that replaces ads with slogans from John Carpenter's 1988 film They Live instead of hiding themhttps://github.com/davmlaw/they_live_adblocker
TerminalPhoneCLI messenger (with voice messages) that operates over torhttps://gitlab.com/here_forawhile/terminalphone
Cuda Oxide"Rust-to-CUDA compiler that lets you write (SIMT) GPU kernels in safe(ish), idiomatic Rust"https://nvlabs.github.io/cuda-oxide/index.html
Wario SynthBrowser-based midi player + search engine (doesn't look like you can easily download the midi filies)https://www.wario.style/
Jmail & EpsteinExposedEpstein files search engine (seems very US-focused: I tried looking for a few non-US people and found nothing)https://epsteinexposed.com/
Wikipedia Doomscroller"pseudo social media feed that algorithmically shows you content from Simple Wikipedia. It is made as a demonstration of how even a basic non-ML algorithm with no data from other users can quickly learn what you engage with" (AGPL)https://xikipedia.org/
PuterI'm not 100% sure by looking at the homepage, but it would seem it's a containerized desktop you can access via web (think webtop)https://github.com/HeyPuter/puter
HonkerSQLite extension providing functionality similar to postgres' notify/listenhttps://github.com/russellromney/honker
Yes, these are 9 and not 10... Sorry, I only see 9 in "Topics Covered" above and I don't want to go to youtube (I've already
wastedspent enough time on this). If you can, pls integrate the list with the 10th project by replying here.