moonpiedumplings

joined 2 years ago

The way forgejo actions works, is that it is not a universal thing for every repo. Each repo, can have it's own forgejo actions instance connected to it, running stuff.

The big benefit of that, is that you can make users bring their own actions servers, and not bother to deploy your own.

[–] moonpiedumplings@programming.dev 1 points 1 day ago* (last edited 1 day ago)

It has newer packages than Debian.

This is not quite true. They have overlapping release cycles. A new Debian release will ship frozen versions of the latest packages, causing it to have newer packages than most ubuntu releases. Then the new ubuntu release comes out, with and it has newer packages. Ubuntu doesn't universally newer packages than debian. The difference is that Debian ONLY does security updates, and doesn't do feature updates or even bugfixes over it's lifespan. Ubuntu, on the other hand, does ship feature updates and bug fixes, incrementing the package version as they go over the lifespan of an Ubuntu release.

Comparing the bash versions of the latest ubuntu stable version versus the current debian stable, and you'll notice that Debian has a newer bash:

[moonpie@osiris moonpiedumplings.github.io]$ podman run -it --rm debian
root@980ac170ddb4:/# bash --version
GNU bash, version 5.2.37(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
root@980ac170ddb4:/# exit
exit
[moonpie@osiris moonpiedumplings.github.io]$ podman run -it --rm ubuntu
Resolved "ubuntu" as an alias (/etc/containers/registries.conf.d/00-shortnames.conf)
Trying to pull docker.io/library/ubuntu:latest...
Getting image source signatures
Copying blob 817807f3c64e done   | 
Copying config f794f40ddf done   | 
Writing manifest to image destination
root@1486a1c38699:/# bash --version
GNU bash, version 5.2.21(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

This is Ubuntu 24, the current stable release. 25/questing, the rolling version does have newer/same package versions of debian. But people don't base distros off of the rolling version of ubuntu, only the stable releases.

[–] moonpiedumplings@programming.dev 25 points 1 day ago* (last edited 1 day ago)

Debian Linux, and many other Linux distros, have extensive measures to protect their supply chain. Packages are signed and verified, by multiple developers, before being built reproducibly (I can build and verify and identical binary/package). The build system has layers, such that if only a single layer is compromised, nothing happens and nobody flinches.

Programming langauge specific package repos, have no such protections. A single developer has their key/token/account, and then they can push packages, which are often built on their own devices. There are no reproducible build to ensure the binaries are from the same source code, and no multi-party signing to ensure that multiple devs would need to be compromised in order to compromise the package.

So what happened, probably, is some developer got phished or hacked, and gave up their API key. And the package they made was popular, and frequently ran unsandboxed on devs personal devices, so when other developers downloaded the latest version of that package, they got hacked too. The attackers then used their devices to push more malicious packages to the repo, and the cycle repeats.

And that's why supply chain attacks are now a daily occurrence.

No, they're dual licensed. Canonical has users contributing signing a Contributor License agreement, in which they agree to allow Canonical to distribute alternatively licesed, or proprietary versions.

This change was somewhat controversial, and partially why Incus was forked from LXD.

[–] moonpiedumplings@programming.dev 9 points 2 days ago (3 children)

Companies at onferences give 4/8gb out sometimes. They buy branded ones in bulk.

Maybe: https://xyproblem.info/ ?

If you want to use syncthing remotely tha the answer is probably wireguard/other vpn.

[–] moonpiedumplings@programming.dev 2 points 3 days ago (2 children)
  • oauth, and control sign ups via there. Don't let people sign up via forgejo itself.
  • anubis, yeah. Or similar.
  • forgejo actions is an optional component... and forgejo users can bring their own actions server. Of course, it's a risk to them since the server owner could execute code in actions. But yeah.

Nuitka is interesting. The articlenotes that it compiles python to bytecode, instead of bundling an interpreter, which is true.

But what the article doesn't mention is that Nuitka has a paid version, which includes a feature of code/binary obfuscation, in order to make reverse engineering more difficult. I wonder if hackers used the paid version?

Void auth, or kanidm look like easier alternatives.

I have installed an OS onto just the btrfs root subvolume, leaving the home directory intact. This is how I originally swapped from Manjaro to Arch. The arch manual install instructions helped.

But this should be a feature of the graphical installers imo.

[–] moonpiedumplings@programming.dev 2 points 1 week ago (1 children)

Transparent fileystem compression and deduplication (btrfs feature not in ext4) compresses data while still having it be accessible normally. This leads to big space savings.

You can use the tool compsize to check it out.

 

Finally I can doomscroll books

 

As usual, phoronix is full of trolls. I was surprised to see only 17 comments, but perhaps that's because I viewed this very early. A highlight from the first page:

Everyday we stray further from GNU, POSIX, C, X11 and now SysVinit. 80s are over. Party is over. Wake up. It's 2026. Adapt or perish in irrelevance. Future is bright and is inevitable. Long live systemd, Wayland, Rust, Gnome and atomic and immutable distros.

Given the way this covers Systemd, SysV, and AI agents, and the way that I see trolling on the first page, There is a very real chance this could be one of those legendary Phoronix threads that manages to hit the 500 comment limit.

EDIT: more relevant threads: https://www.phoronix.com/linux/systemd

 

Youtube video: https://www.youtube.com/watch?v=xrIFL7wSRw4

I am excited about the changes to incus-migrate that allow for direct importation of a remote qcow2 or vmdk. Although many people distribute vmdk's zipped or in tarballs, but it's still a cool feature.

 

Sample with fibonacci:

⍥◡+9∩1 is the fibonacci in this language

 

Here are some cool examples I was looking at:

https://github.com/zardoy/minecraft-web-client — Minecraft in your browser, complete with connections to servers.

https://github.com/inolen/quakejs — quake 3 in your browser, has multiplayer as well.

Any other good examples? or good lists?

 

cross-posted from: https://programming.dev/post/45725210

I noticed in a fairly recent version of KDE, my computer would pretend to be a bluetooth sink when connected to devices like my phone.

This is a really cool feature, and I really like it, because it lets me stream audio from my phone to my computer with no fuss.

However, there is an annoying glitch where the stream stops all of a sudden. The phone keeps playing the music, but I can't hear anything. I've noticed that this seems to have something to do with CPU usage, like when I switch windows rapidly or do something that requires CPU the bluetooth process is dropped. The only reliable way to fix it is to disconnect and reconnect, or wait a minute, and then it works again. Is there any way to fix this more persistently?

I am using CachyOS + KDE right now.

 

I noticed in a fairly recent version of KDE, my computer would pretend to be a bluetooth sink when connected to devices like my phone.

This is a really cool feature, and I really like it, because it lets me stream audio from my phone to my computer with no fuss.

However, there is an annoying glitch where the stream stops all of a sudden. The phone keeps playing the music, but I can't hear anything. I've noticed that this seems to have something to do with CPU usage, like when I switch windows rapidly or do something that requires CPU the bluetooth process is dropped. The only reliable way to fix it is to disconnect and reconnect, or wait a minute, and then it works again. Is there any way to fix this more persistently?

I am using CachyOS + KDE right now.

 

0patch provides "micropatches", that replace running windows code in place, fixing security issues rapidly without requiring an update/reboot.

I really want something like them for an upcoming cybersecurity competition, specifcally patches for the zerologin and eternalblue vulnerabilities.

Unfortunately, 0patch does want a credit card for the free trial, which makes it unfeasible for us to use.

Any alternatives?

 

Has anyone tried this? It's discord reverse engineered.

 

Inspired by this comment.

I'm curious.

 

Tldr we want a static website that will last a long time and also look pretty nice.

Right now, we have a wordpress website. It looks very nice. It also have 4 extensions that aren't configured to auto update. Also whenever I try to make changes to the website they don't apply because the website was configured via the extensions and I hate it.

I want a static site of some kind. It's simple to self host or host anywhere, and it's also simple to secure and keep maintained for a long time.

I am currently looking at static site generators, like quarto, or docusaurus

However, they are difficult to theme to the "niceness" that I want, and their nature results in these somewhat fixed output formats. Like, it is somewhat difficult and annoying to put images anywhere I want them and etc.

Is there like a fixed WYSIWYG html editor? Something between designing a website from scratch and a static site generator. Or is there a way to finagle static site generators to be more flexible than blogs or documentation sites?

 

I hate all three. I understand some of the decisions but other ones are frustrating.

Let me explain what I used to do. What I used to do, is take advantage of the fact that firefox profiles are completely separate instances of firefox, each with their own settings and extensions. I would run my personal profile with highly aggressive and experimental settings, because I was ok with it crashing if it meant I learned interesting things. On the other hand, the profiles related to schoolwork and other more important tasks would be defaults, so they would be much more stable. I no longer consider this a necessary feature, but it was fun to play with.

The other big reason why I relied on the old profiles, is because they have separate cookies and whatnot, which is useful for when I want to have an account for each profile. Although Google happily lets you sign into multiple accounts from the same browser, Microsoft, Discord, and many other apps do not, and force you to sign out before signing in again.

But this is painful. Things never open in the profile I want them to by default, which is annoying. In theory, and I am considering doing this, the way to fix it is by creating app menu shortcuts for each profile, and then having them be the apps I select whenever I want to open a website link or file (with no default profile/app set, so I just select every time).

In addition to that, each profile had to have it's own mozilla account for syncing, which was annoying.

Containers seemed like a nice in between. I could use a single mozilla account for sync, but have seperate microsoft or other accounts on the same browser instance.

Except nope, they actually suck and don't work like that. I can't decide a window is dedicated to a container, so all tabs from xyz site will open in that container and give me that account. It constantly prompts me and it's painful and the UX for what I'm trying to do is miserable.

Containers seem designed more for isolating cookies between two different sites, rather than hiding instances of sites from themselves. Like the original version was a "facebook container", which would hide the facebook cookies from other sites, but I don't want that. I want to be able to log into multiple facebook accounts (hypothetically, I don't actually have a single facebook account but you get the idea).

The new profiles, if you've heard of them, somehow manage to combine the worst of both worlds. Firstly they are an entirely separate system and can't be managed by the second profile system. But they exist within a single one of the old profiles, meaning I can't do tricks with desktop shortcuts to make apps open in one profile or the other. But at the same time, despite existing within one profile, they each require seperate Mozilla accounts for sync.

I am very frustrated, but als resetting up my system so I am considering what to do. I am probably going to continue with profiles, but add app menu shortcuts for them.

Any better ideas?

view more: next ›