Viewing profile — raggi

One of the strongest teams I worked with, working on an extremely large and ambitious project used to answer a lot of product/executive type questions regarding missing areas that …

So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure fr…

i've seen it, so the answer is non-zero

Next step the ads become increasingly sophisticated prompt injection to ensure they make it to the user, but the prices plummet in the meantime because the ads have low efficacy. T…

When you see people advertising a coffee shop at a conference and people TOFU'ing on conference wifi then plugging in credit card numbers, the picture gets a little more clear.

Fair! When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.... Unfortunately neither of us has t…

sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in …

here, less than most, but look for ssh agents on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there

Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.

fwiw, we have been working on increasing modularity options in the client and a substantial volume of features can now be built out of the clients, see https://github.com/tailscale…

The mental model of slow decay into copyable is complicated. The code base is already a wash with contributions that have low copyrightability in US case law anyway, things derived…

Parse for what? The model has “arbitrary understanding” of “arbitrary input”. The filter is unbounded and the only actually safe result is to filter everything.

with LLM architectures I think that’s true, and we don’t have anything looking particularly competitive for large scale use atm I also don’t think this is about mixing, the LLM par…

Honestly we should just do this. Maddy and Stalwart have cheap enough concurrency and good enough scalability they could easily delay SMTP accepts server side for a time delay base…

This presentation wasn’t too bad in terms of us vs theming, but in general throughout the lifetime of the project there’s been a strong us vs them rhetoric. I think it’s working as…

[dead]

In my experience once you get to the point where you run out of space in the glob you’re often suffering with poor performance from spawning children as well and it’s time to move …

in zsh you can just write: for x (*.sh); echo "before $x after" or for x in *.sh; echo "before $x after" or for x (*.sh) { echo -n "before "; echo -n $x; echo " after" }

there's tons of frustratingly equally bad precedent. for some reason it also seems like a lot of this companion software from oems is often written by part time contract / interns.…

Most variants don't, Alpine in fact does not, nor does the uclibc shell script, nor the commonly copied in implementation in many busybox environments. Reference: https://gitlab.al…

Yes

The fact that there is no portable way to link the relevant functions that works reliably across all distributions of Linux is a failure of POSIX and GNU, and unfortunately is larg…

http://github.com/tailscale/tailscale/commit/e4144230f410204...

I have been fed up with DNSimple for a long time. Can any folks share positive experiences with Bunny?

fwiw I’ve been running lots of stuff under niri with proton Wayland mode for the last ~6 months on nvidia with a vrr display and it’s been fine. Can’t diagnose here, and not meanin…