Hacker Newsnew | past | comments | ask | show | jobs | submit | glennpratt's commentslogin

Comparing systemd and Kubernetes for this scenario is like comparing an apple tree to a citrus grove.

You can specify just about anything, including exact nodes, for Kubernetes workloads.

This is just injecting some of that automatically.

I'm not knocking systemd, it's just not relevant.


I agree, except I've been much happier with Wellbutrin. After getting through the initial insomnia a few years ago and switching to normal release, not extended, I have good focus and don't have tremors or back pain like I did with stimulants.


> do Android "business profiles" also include browser sessions

I believe that is typical.

My business profile has it's own instance of Chrome. Mostly used for internal and external sites that require corporate SSO or client certificates. Of course it could be used to browse anything.


The Elantra N is not electric.


I'm not GP, but perhaps something like the following would be a reason (investigation might be a more accurate term than post-mortem in that case).

>In October 2020, Vista's CEO Robert F. Smith and investor Robert T. Brockman were named in a tax evasion case.[33][34] That month, Smith signed a non-prosecution agreement with the IRS, agreeing to pay $139 million and testify against Brockman.[33]

https://en.wikipedia.org/wiki/Vista_Equity_Partners#Tax_evas...


I'm curious why you added `-i /dev/null`. IIUC, this doesn't remove ssh-agent keys.

If you want to make sure no keys are offered, you'd want:

  ssh -a -o IdentitiesOnly=yes terminal. Shop
I'm not sure if the `-i` actually prevents anything, I believe things other than /dev/null will still be tried in sequence.


Check for yourself with

    ssh -v -i /dev/null terminal.shop
vs

    ssh -v terminal.shop
What you're looking for is that there is no line that says something like

    debug1: Offering public key: /Users/fragmede/.ssh/id_rsa RSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Upon further testing, the full command you want is:

    ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop
to forcibly disable a local identity agent from offering up its identities as well, and not just agent forwarding.

Upon further testing,

    ssh -o IdentitiesOnly=yes terminal.shop
still offers up my public key on my system (macOS, OpenSSH_9.6p1, LibreSSL 3.3.6), contrary to what StackOverflow and the Internet seems to think. Tested by hitting whoami.filippo.io, linked in child comment.


Aha, yes, `-o IdentityAgent=/dev/null` is better for my intent. I was confused that `-i` wasn't removing .ssh/id_rsa from the candidates, but that was ssh-agent.

  ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop
That looks pretty solid. Thanks!


For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.


It's quite useful! I can give someone access to my server by grabbing their public key and creating an account for them, no need figure out how to send them the password to my server.


That's indeed how public keys are intended to work.


It's one of those obvious in hindsight things that gives me that "Internet was not a mistake" feels.


Gitlab does the same.

I've seen provisioning scripts and even cloud-init if I'm not wrong supporting downloading keys in that manner.

From one side it's cool from other side allows to bypass of system administrator for keys update more easily.


> You can make a search for all users, which will tell you there are 97,616,627 users at the time of this writing, but you can only fetch at most 1000 results from a search, and they don’t come in any clear order, so you can’t just make the next search start where the previous one left off (or I didn’t figure out how).

> What you can do though is request accounts created in a certain time range. If you get the time range right, so that it has less than 1000 entries, you can paginate through it, and then request the next time range.

This reminds me of when I tried to add a google drive storage backend to camlistore/perkeep (because I had nearly-unlimited free quota at the time). One of the things a perkeep blobserver needs to be able to do enumerate all the blobs it has, in order. You can send millions of blobs to google drive without issue, but you can't directly paginate a search for them in sorted order.

You could just issue a search for all blobs under your perkeep drive folder, keep paginating the result until you run out of pages, and then sort in memory, but there's really no way of knowing how many blobs you're going to end up with and you might blow out your blobserver's memory.

Perkeep blobs are identified by blobrefs, SHA sums of the contents of the blob, so they look like sha-[0-9a-f]{64}. Google drive lets you search for files with a name prefix, so you can search for like /perkeep/sha-* and see if the result has a pagination token (indicating that there are more than 1000 results), and if so then you search for each of /perkeep/sha-0*, /perkeep/sha-1*, ... , /perkeep/sha-f*, each time checking to see whether there are too many matches. When there's not too many matches, you've found the prefix length that will let you fetch a bounded number of blobrefs, emit them to the perkeep client, and then release the memory before fetching more.

  /pk/sha-\*          1000+ results (non-empty pagination token)
    /pk/sha-0\*       1000+ results (non-empty pagination token)
      /pk/sha-00\*    1000+ results (non-empty pagination token)
        /pk/sha-000\*  193  results,
                       sort these in memory and emit to client
        /pk/sha-001\*  179  results,
                       sort these in memory and emit to client
        ...
        /pk/sha-fff\*  223  results,
                       sort these in memory and emit to client
I didn't end up landing the patch before I lost interest, partly because it was pretty much the first golang I had tried writing. It was fun working out the above details, though.


> I tried to add a google drive storage backend to camlistore/perkeep (because I had nearly-unlimited free quota at the time)

This explains the quotas now :)


Offering your public key only allows them to identify the key and prove you have it. There is no security concern in sending this to an untrusted server.

Agent forwarding is a whole other beast.


Hm I thought I'd edited this. I was mistaken,

    ssh -o IdentitiesOnly=yes terminal.shop
works as expected, however I had an IdentityAgent set, and my key was being submitted via that route.

    ssh -o IdentitiesOnly=yes -o IdentityAgent=/dev/null terminal.shop
behaves as expected; same as

    ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop
Verified via whoami.filippo.io.


instructions not clear, my entire drive is empty now


US is 15th in median wealth and it's population exceeds the 14 countries ahead combined. That's a big target.

https://en.wikipedia.org/wiki/List_of_countries_by_wealth_pe...

Your question seems like a false dichotomy.


US is basically below the EU for wealth with a smaller population. Your response appears to be ignoring the basic facts. So while the US is a big target, targeting the EU on money and population wise would be better, yet they choose to focus on USPS because that converts well.

Since we can assume the US does not have as much disposal cash as the EU since they earn less yet have more wealth. They have less people than the EU. It's that USPS converts specifically well. It looks very likely the reason it's USPS is that folks from the US are very easy to trick.

While I understand it's unpleasing for US citizens to admit that their population is easier to trick. But if they improve their education and stop being so far down in the charts this might not be the case.


What is EU's common language and postal service? I get a lot of email from European vendors, intended for Europeans who don't know their own email address, and that email is not all in the same language.

Anyway, US GDP is far in excess of EU GDP, for example. https://www.lemonde.fr/en/opinion/article/2023/09/04/the-gdp...

You aren't doing your contintent-mates any favors with your flailing attempt to prove European intellectual superiority.


I pack some backup clothes (undershirt, underwear, socks), they mostly stay in my bike bag because I rarely use them. If I do need them, I just go to the bathroom, then change back into the bike clothes for the ride home. If it's really hot, I might switch it up and put the office clothes in the bag from the start - meaning I know I'll need a change.

Really not that complicated.


> Zed supports GitHub Copilot out of the box, and you can use GPT-4 generate or refactor code by pressing ctrl-enter and typing a natural language prompt. https://zed.dev/

Seems like that ship has sailed. Maybe it's a plugin already or could be in the future, but that's not on GP's suggestion.


I'm already picturing a "Zedium" fork for the FOSS/Privacy enthusiasts.


This made me chuckle. Then at the same time I find it disheartening that privacy is currently seen as an enthusiast position rather than the default. I really dont mind the idea of these anti-privacy things being included as long as I have an option to turn them off before running Zed for the first time.


To use them you’d need to already have a copilot subscription, and the GPT-4 thing apparently requires you to deliberately invoke a command. I’d say it’s pretty safe by default.


I’d say the ship is in port but ready to sail. Before this does anything you have to provide your own API key. So it’s off by default. It’s just the button that is there.


I’d much more prefer keeping all these Ai tools as plugins to keep the editor light.


I don't think it's comparing LA to anything other than their Adventist upbringing.


Yes. If one is from a culture where almost everyone plays something, even if not especially well, then most other places will feel barren in comparison.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: