I am more concerned about sharing something that someone can use to get access to my things that I keep locked away.
I still have it public but I try and think about what I am pushing before I push.
Dotfiles feel too personal to share
121–130 of 153 posts
Re: Dotfiles feel too personal to share
#122Earlier quoted context omitted.
Also, if you have useful nice shelves that make your fridge aka postgres run better, why shouldn't we work on putting that on servers to make all fridges run better? Also, having a comparable and shared admin experience is a big deal in a team. Like sure, if you need to quibble about red or yellow prompts, eh. But if there is a good log colorizer or analyzer that makes an expert better at handling the system, or some…
> I want this deployed for _all_ admins on _all_ relevant systems. Another user above mentioned that his most important config is mapping j to gj. That would drive me nuts. When lines are so long that they wrap, I want j to go to the next line, not the next however-wide-the-terminal-is. On the off chance that I ever want that, I have gj right there at my literal fingertips. You're never going to find a config that ev…
I was rather referring to things like: Aliases to access important log files. Aliases to supply security credentials to important commands. Coloring logs so relevant details are highlighted.
If your biggest problem running a system is the line-next semantic, you're in a much better place than I am. No one on the team has ever raised that.
Re: Dotfiles feel too personal to share
#123I get this feeling.
I have a setup with my Emacs configuration that uses a file that is meant to live locally only, since I feel the contents of it feel too personal to share. (These are mainly Org-mode settings for specific file names and directories).
https://github.com/cyrialize/.emacs.d/blob/main/private-temp...
Re: Dotfiles feel too personal to share
#124Earlier quoted context omitted.
This is extremely alarmist. If you are on Mac, developing anything at all with Python, those are going to be your tools. If you randomly guessed at developer setups, that is going to be one of the most common setups as well. What's next, I use a computer so someone could just upload a virus somewhere in hopes I happen upon it, which would be dangerous? I have dotfiles which not only specify Python, but also its versi…
It is absolutely not alarmist. Seriously, go apply to be a Homebrew developer right now under an alias, make some useful updates for a few months, then submit a PR as another alias, and approve and merge your own changes from the first alias. After you get away with skipping code review a few times, now go switch a popular package that relies on abandoned sources to point to your fork that makes a few legitimate upda…
> Seen these attacks in the wild many times, some at close range.
Not skeptical, just curious - do you have like a list of publicly reported incidents out there that we can read to ourselves during bedtime and maybe scare ourselves into changing our habits?
Re: Dotfiles feel too personal to share
#125Too personal to share, but maybe too personal and important to share even with the members of the cloudy cartel, i.e. the Providers. Is exactly why I wrote myba that does full contents and paths encryption before syncing with the lapsable remotes ... https://kernc.github.io/myba/ Some things are better public. Some are not ...
I can no longer edit my original dot manager comment so to add some context: I developed an allergy for the term "vibe-coding" (and made a joke on the selection of OPs words), AI won't turn a lazy unskilled inexperienced person into John Carmack, lazy person + AI still equals to a lazy person. With that being said, most of you may have already experienced a divide between the above empirical truth and management decisions across your favorite corporate environments. So, the race is on, AGI-level agentic frameworks may be here soon enough to mitigate the above, then again, in the end isnt the enduser of most of our economic production directly or indirectly a human? Can a synthetic immortal system really cater for human needs? There is a reason why big deals are always negotiated in-person
Re: Dotfiles feel too personal to share
#126This article feels like it’s about what and how this person stores their dotfiles and then has two lines about them feeling too personal to share. I’m surprised it’s so highly voted since it’s basically “I use stow”.
Must be due to the interesting title.
Re: Dotfiles feel too personal to share
#127I used to use chezmoi and had a great experience with it .It made it easy to choose exactly what I wanted to share. These days, I don’t have many devices, so I stopped using it. Still, it feels great when someone asks, “How did you set that up?” and I can instantly share my entire configuration through a GitHub repo.
I found the syncing process in chezmoi to be so hard to mentally model. I’d often change a file, forget that it was backed by the chezmoi store, later find myself trying to reconcile the differences, just so I could commit and share w/ another computer. nix + home-manager and snowfall lib, once over the multi month ramp up, have been such a breath of fresh air in multi system management
I ended up writing some pretty hacky elisp to automatically load my chezmoi templates if I try to edit a Chezmoi-managed file. It'll also handle applying and pushing saved changes to my git remote so I don't forget that either.
https://marcusb.org/posts/2025/01/frictionless-dotfile-manag...
Re: Dotfiles feel too personal to share
#128Too personal to share, but maybe too personal and important to share even with the members of the cloudy cartel, i.e. the Providers. Is exactly why I wrote myba that does full contents and paths encryption before syncing with the lapsable remotes ... https://kernc.github.io/myba/ Some things are better public. Some are not ...
That looks nice! The moment I started syncing dotfiles between my work and personal computers, I know it was an error because very different reasons. Difficulty of maintaining different OS details (Linux vs MacOS). What if leaked a private key or a sensible path. What if a pushed to the wrong place or somebody made public the wrong repository... When reading your comment something and idea came to mind about using so…
I am trying to contextualize git-based dotfiles.
$ context set universe://work/customer-a/devops --update-dotfiles
$ context set unvierse://work/customer-b --update-dotfiles
$ canvas dot apply user.name@remote.id:workspace-foo
$ canvas dot apply user.name@remote.id:workspace-bar/shell/bashrc
yes, complicated, probably hard to comprehend/reason about, work in progress
Re: Dotfiles feel too personal to share
#129Earlier quoted context omitted.
It is absolutely not alarmist. Seriously, go apply to be a Homebrew developer right now under an alias, make some useful updates for a few months, then submit a PR as another alias, and approve and merge your own changes from the first alias. After you get away with skipping code review a few times, now go switch a popular package that relies on abandoned sources to point to your fork that makes a few legitimate upda…
Could you clarify what you mean by 'attacks like this happen every day' please?
Here are just a few old well known examples in popular package managers:
* Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d...
* Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00...
* NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...
* PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_...
* Ubuntu Snap: https://github.com/canonical-websites/snapcraft.io/issues/65...
* Arch Linux AUR: https://lists.archlinux.org/pipermail/aur-general/2018-July/...
* Homebrew: https://medium.com/@vesirin/how-i-gained-commit-access-to-ho...
No one has fixed the fundamental problems that allow any of these to happen after years and years.
Now put "supply chain attack" into any news search engine today.
Attacks of this nature are up by 400-1500%+ in recent years depending on whose estimates you trust. They are easy, they are common, they are everywhere... and most security engineers and sysadmins are entirely asleep on the wheel on this one.
Most of our consulting work these days is mitigating these risks in the most critical deployment and code paths of our clients.
Re: Dotfiles feel too personal to share
#130I would like to say an enormous thank you to Dave, who after a huge amount of pestering (and probably to try to save himself from further pestering) shared his .emacs filetree with me and told me to learn Lisp.
Be generous with your dotfiles, and especially with the young and curious engineers who ask lots of questions about your setup. Pay it forward.