sgtcodfish

7 ms·

1.
by sgtcodfish 8mo ago
cert-manager maintainter chiming in to say that yes, cert-manager should support IP address certs - if anyone finds any bugs, we'd love to hear from you! We also support ACME profiles (required for short lived certs) as of v1.18 which
2.
by sgtcodfish 1y ago
As an active maintainer of cert-manager (which is CNCF graduated), I can shed some light here. It's not just "give away trademarks for nothing"! The CNCF pays for cert-manager's testing, web hosting and infrastructure co
3.
by sgtcodfish 2y ago
They might try - that's why it's important if you're generating + committing generated code that you also have a CI step that runs before merging anything which ensures that the generated code is up-to-date and rejects any ch
4.
by sgtcodfish 3y ago
Plug (but it's open source and free - and mentioned in the article!): We've been trying to address this in Kubernetes with trust-manager. [1] Trust bundles need to be a runtime concern and they need to support trusting both the ol
5.
by sgtcodfish 3y ago
Having the communication in cleartext also makes it much easier for attackers to interfere with! Sure, they can't modify the .deb without failing signature verification, but they _can_ inject arbitrary delays in downloads or interfere
6.
by sgtcodfish 5y ago
This is super interesting; we had a fairly long discussion about whether or not to add this action to cert-manager[1], and ended up rejecting it in part because it increased the risk of supply-chain attacks and that risk wasn't, in our
7.
by sgtcodfish 6y ago
This mirrors my experience, too. Building a simple RPM isn't too bad, even if spec files are a little arcane. Packaging for the AUR isn't super complicated as far as I've seen. The "standard" way to build even the s
8.
by sgtcodfish 7y ago
Do you have an example of a situation where a problem in systemd required you to patch the source and recompile, or are you just making a general statement? Specifically a problem that couldn't be fixed by changing systemd unit files?
9.
by sgtcodfish 7y ago
I currently have a messy side project[1] where I'm writing bare-metal RISC-V machine code (i.e. writing in hex after assembling instructions by hand) targeting the SiFive HiFive1. QEMU is handy for testing since it supports that board
10.
by sgtcodfish 7y ago
As others have said, if you're gonna be reaching that kind of timeout, the use case would come under this caveat I mentioned: > assuming the task isn't hugely inappropriate We have a couple of cases where reasonably small files
11.
by sgtcodfish 7y ago
My experience with serverless (mostly AWS Lambda) is that I've found 3 major use cases where it's been a very successful choice: 1. as a cron-style job (e.g. download a file every hour and put it in S3, or connect to a DB and do s
12.
by sgtcodfish 8y ago
I've been thinking about this sort of thing a lot recently in terms of our heavy use of Troposphere[1] which is a Python abstraction over AWS CloudFormation and how much better that abstraction is than just writing HTML (in the case of
13.
by sgtcodfish 8y ago
I was happy with Namecheap until they redesigned their website and included a tonne of JS which slowed everything down. Doing something as simple as changing an A record became unbearably sluggish, and I tend to think I have a fairly high t
14.
by sgtcodfish 8y ago
The Economist has been editorially pro-legalization of cannabis for a long time so any propagandizing agenda you think you're "sensing" just isn't there; in fact their agenda is literally the complete opposite of what yo
15.
by sgtcodfish 8y ago
There are proposals to add generics soon: https://go.googlesource.com/proposal/+/master/design/go2draf... It's not a question of whether or not it's easy or hard; it's definitely technical
16.
by sgtcodfish 8y ago
At the BBC we use mutual TLS extensively in our cloud-deployed applications, across a lot of developers and different teams, for both service-to-service and developer-to-service auth (all devs get a client cert). It works well for a lot of
17.
by sgtcodfish 8y ago
At least one tiling Wayland WM already exists, as a drop-in replacement for i3: http://swaywm.org/ Hopefully your fears are sufficiently alleviated by that! I suspect you've got a mistaken idea about what Wayland actua
18.
by sgtcodfish 8y ago
If you're on Android, you can do this today with Termux. I believe you can also set up shortcuts (so you could have a home screen widget to open your TXT file).
19.
by sgtcodfish 9y ago
The article linked in this post directly addresses (3) as being an absolute non-issue spread by FUD, and the whole article is about (4) being very probably untrue. It also goes into solid detail on the extent of (1) and (2), neither of whic
20.
by sgtcodfish 9y ago
You can get the same amount of "bits" of security with EC as you can with RSA for sure if you choose the right parameters. There are also EC implementations (Ed25519 being an excellent example) which are incredibly simple which ma