skysight-inc/HackerNews huggingface dataset:
Ask HN: Building a Linux Appliance. Ideas for config management and automation?
Hi All

Can I ask for a sanity check please?

I have built a Linux Appliance. It is delivered via CI/CD as an ISO or AMI, and autoinstalls with a simple guided menu-driven workflow and then does "security type stuff". It runs a few services on network traffic and sends results elsewhere. Consider it a "data collector" used for security investigation.

It's pretty dumb: It does one thing only. It's an appliance. The end-user has no access to the console or shell.

The menu system allows the end-user to change certain key parameters (interface related, ntp server etc), stop and start services and get stats on what's going on. All of this is done in bash - for example changing /etc/network/interfaces files and restarting internal services to change IP details.

However, the menu system is a bit of a mess. It's written in shell.

If you wanted to re-factor this, what would your approach be?

I would like to:

- Rewrite the menu system in a more appropriate language (Python or Go)
- The menu should output a config file (which would therefore allow appliance cloning, back-up and restore etc).
- That simple config file should be parsed and applied to the system by an additional service.

So:

- Python for the menu system
- This writes a YAML based config
- A separate Python service converts the simple appliance config into appropriate config for an automation framework
- Let the automation framework do the heavy lifting - Salt or Ansible.

This way I can use automation framework to do the difficult and fiddly parts of Linux configuration and only need to worry about the commands.

Does this make sense?
OP implies that the devs were the ones who wrote the headline though. They clearly stated that it is not (yet) a sound alternative to Discord.
Struts 1, right? None of this Struts 2 nonsense :')
He’s not complaining about it missing the features he wants, he’s complaining about it missing features of the products it’s presenting itself as an alternative to
In what way is ipfs a monster? It is a single go binary that does a tiny number of jobs.
So say you are liquid for 1000 bucks with average credit and a 50 hour a week time commitment to working and commuting to earn just enough to get by.

This or worse is about half the country

You need expertise, time, and money to start a business. The majority of people lack not one but all 3.

This is probably why only 9% own an established business. Indeed jp Morgan says that future business owners on average start out substantially wealthier.

https://www.jpmorganchase.com/institute/research/small-busin...

Which supports my assertion that the majority are ill positioned to start a business.

Money buys time, money buys relevant expertise in, wealth makes risk tenable because failure doesn't mean homelessness, money and financial health in fact buys access to borrowed money.

Everyone could just do what only 9% of people do is an incredibly privileged thing to say it's like Zuckerberg saying anyone can have a website or bolt saying anyone can run.

It's insulting.
Not sure it's related, this set of statements is not about statements containing themselves or the set itself. You need a set of sets for the Russell paradox to have chances to kick in.
If you are up for some hardware tinkering, you might be able to modify an existing KVM switch to add remote control.

I had a KVM switch with a wired button (place KVM out of the way, put small button on your desk). The button was connected via a 3.5mm "audio" jack. I never measured the interface, but I bet it just connected two rings of the jack.

Using a switch like that, you can build your own control for it without opening the KVM. Either with an ESP for wifi control (MQTT would be my choice) or a smaller board for USB/serial control (Cortex-M dev board). Short the proper rings via an optocoupler controlled by the MCU and it will behave as if you pressed the button.
Doctors in the UK use Omron monitors.
Bitwarden has built in emergency access: https://bitwarden.com/help/emergency-access/

That coves these kinds of cases reasonably imo: you can invite somebody, and then that person can later request access when that's necessary. That sends you a notification, and they're granted access if you don't object within a preconfigured time window.

Obviously there's some trust required and/or a sufficiently long window, but it's one of the better solutions I've seen.
As much as I hate to say that, they are right. If you want to be a significant competitor to centralized plateforms, you gotta at least do as much at them.
There are more cost-effective chips for those.
That's a shame, sorry to hear that. I got more lucky: I had to wait for 6 hours too but my flight suddenly resumed (must have been one of the first few). I didn't have any alternatives to go home either so I feel for all of those stuck in a foreign country.
Well, XMPP is nice, but ZeroNet also seems like a monster.
Depends what you're logging. An info level log is quite explicitly for an expected path, e.g. "config not found, using defaults".

This rule is only for error calls, though. In that case, yeah, you wouldn't log an error for an expected path.
If you're hosting your applications on localhost it can be a security risk.

A blind SSRF vulnerability (with payload control) in your application could be used to gain full control over the reverse proxy resulting in the attacker gaining full unfettered access to your network.

If you're not using it (and you shouldn't be using such functionality on a production machine), then you don't need it and should disable it, see: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
Perpetual motion isn't tech, it's a scam.

https://www.youtube.com/watch?v=tuxbMfKO9Pg
> Once we have the technology to accurately and passively measure blood pressure throughout the day, preventive medicine will become much easier, and people will have a better feeling for how their blood pressure responds to small changes in their environment and lifestyle.

With 70% of the population being overweight or obese and on a dog shit diet I very much doubt that.

We already know what we do is bad, we know how to fix it, virtually no one does it. If people can't be arsed to even walk 30 min a day I don't think they'll care about continuously monitoring their blood pressure. You can track your pulse continuously with ultra cheap gadgets and it'll tell 50%+ of the population their heart is in bad shape, nobody cares

The best preventative medicine is your lifestyle, if you wait for symptoms you already failed your body and are 10+ years late to the party
If having 3b market cap is considered failing, I sure would love to fail as many times as possible
Can you provide some evidence for your first sentence?

As far as I can see, this article is about a prediction made by theorists about the evolution of certain quantum devices when you frequently measure part of it. This was a nice theoretical idea which has now been tested experimentally.

The article itself does not seem to contain any claim of quantum supremacy, even for this specific subject. Also, while I think the research is really cute, I do not see it being 'actually useful' in any sense - and the article also does not seem to make such a claim.
> transformers are more than meets the eye.

Really?

Transformers are very simple electrical machines. The design process is complex but the object itself is made of mild steel for the tank and supporting frameworks, special steel for the core, copper or aluminium for the windings, paper and resin for insulation, and oil for insulation and cooling.

There are a few ancillary components to do with detecting faults and switching taps and sometimes pumps to circulate the oil through radiators.

Apart from the pumps, circulating oil, and tap changer, there are no moving parts.

There are no compulsory electronic components in even the biggest transformers. Apart from improvements in material quality and the design process a power or distribution transformer built now is really not very different from those built a hundred years ago. In fact there are many transformers that were built fifty years ago that are still in service. Occasionally such transformers are repaired rather than replaced when they fail, quite often the original drawings are still available.
It's convenient and mostly not an issue.
We can expect these posibilities:
1. no life
2. simple life
3. advanced intelligent civilization

In the first two cases, we need to send a physical probe there. In the third case it might be enough, and much faster, to send communication signals there and get answers back. The third case is also arguably the most interesting.
Oh, you think all the other Germans are complaining or weird about it? They also enjoy the pose. It's powerful, it shows determination, etc.

Also, I'll do what I please while I use your country, thank you very much.
Perhaps not, if the speed you can drive a probe is increasing with technological development it might be a waste of time to send a probe that'll be overtaken by its newer sisters.
> That was exactly my point; you're using Firefox's containers for privacy, and it actually doesn't help, at least since they deployed "Total Cookie Protection" by default:

It does. Total cookie protection isolates per-site. What containers allow is for you to say, open a single review site in two different containers, and click on an Amazon link on that review site and not have the same Amazon cookies shared when you do so. It also allows you to very easily set per-site clearing settings for those 3rd-party cookies rather than relying on more cumbersome browser settings.

Total cookie isolation is a great feature but it's a very passive feature with very defined boundaries. Yes, your FB tracking cookies get isolated to the 3rd-party site requesting them. But when do those cookies get cleared, how do they get shared when browsing the same site? It's not just about saying "I want multiple Facbook logins at the same time", it's also about saying "I want this browsing session to be isolated even if I'm revisiting a site that has 1st-party cookies set, even if I'm loading 3rd-party cookies via a domain I've already visited."

By the logic you're supposing, private browsing windows themselves didn't have a purpose after total cookie protection was launched. But being able to fully segment site data by an arbitrary boundary beyond just domain boundaries is useful, and being able to set custom rules including (as this extension demonstrates) even custom proxy rules for how data within that boundary gets treated is even more useful.
If your server reaches out to user-provided URLs, it can be a big deal. Especially with DNS rebinding, remote users can bind domains to 127.0.0.1. Which avoids cors like protections.
Beer! :D (Not joking!) I am a Swiss and drink 2-3 beers every day. Haven't got more than a cold the last 2 years. Long term effects - no idea. Happy work environment too. Vitamin C, D and B every morning.
You didn't read anything, there's very little content. It's just a narrative.

The author split a group of users off an established website and used it to build his own reputation, under the banner of a 'belief system'.

The author mentions concepts that exist and should be defined out, like prioritization and belief, but does absolutely nothing to fill in those blanks with useful information.

I'd be wary of membership with these 'belief system' based groups. The narrative self-promotes excessively, promises everything and delivers nothing.

Expect to see more of this as the desire to be in the 'inner circle' or members area increases.

There's nothing on the other side of the velvet rope, but it does destroy institutions and the craft of software by taking people and knowledge off the map.

In the end, it's better to walk away.
Yeah, I’d say Hector Martin’s got at least the most complete example of Rust code that can go into the kernel. Though he’d be far better off working alongside actual distro maintainers as he focuses on the M1 driver, rather than bandaid-fixing his distro because he can’t handle GRUB.
Most people would expect that `sudo` and `curl localhost:2019` are very different permissions, that is, curl with post payload `-d '{"admin":{"remote":{"listen":"0.0.0.0:2019"}}}'`, and you'd only have to convince an existing process to make the request.
I don't think it's the authors' choice what the word means lol. The "6 definitions" are how people use it in the English language

People are expecting this woman to play God, it seems
I've had my firstname @ my lastname .com for 25+ years now, and it's never been more tedious than repeating it once. People deal with other domains in e-mail addresses all the time.
Well it's less that they rewrote it in Rust for the heck of it and more that they wrote it in Rust for the heck of it. Seems like it's going OK for them, though.
This one works fine for me:

https://www.yepkit.com/product/300110/YKUSH3
My comment is not about changing the language but about the fact that whenever we rewrite it, we improve the quality because of the lessons learned during past iterations.
The question to ask yourself is: After seeing the service clearly degrade, why wouldn't you stop?

Also there may be a good reason why arXiv call it a DDoS attack - they can probably see the same emails being flipped multiple times, which would not be inline with an accidental script issue.
Gatekeepers who hate open access.

https://x.com/emilymbender/status/1696374958652522612
see this tweet https://twitter.com/jayrayner1/status/1701492934703452213
g0v is full of a lot of heavy hitter hackers that run a lot of their own software (including the full gamut of federated software), but a slack server is maintained because that's how the "normies" commonly interact with g0v as a community. Not everyone in the community is an engineer or technically savvy, and unfortunately a lot of these tools really aren't noob friendly. Yes, even IRC.

Getting someone on the g0v slack is as easy as giving them a link. The entire experience is straightforward from there.

Maybe one of the federated softwares is to that point and I don't realize it, I deploy a lot of federated software but I haven't done a chat application in a long time.
Van Gogh painting, stolen 3 years ago, recovered
Apple to Sell Made-in-India iPhones on Launch Day for First Time
> it's no longer present in current Caddy but the bad taste still remains

Adding a sponsor header is harmless (albeit useless IMO). For me that would be no reason to not choosing this software, and certainly no ground for having a 'bad taste'.
That’s fair enough but you can do most of these things in Node too, it doesn’t require a new runtime. You can use browser APIs by installing a wrapper, you can use ES modules, you can (I believe) use workers although I haven’t tried that yet.

The packaging situation is indeed messed up but that’s because TC39 decided to invent a maximally incompatible new module format. But you can not install CJS packages in Node just as well as you can not install them in Deno.

I don’t find configuring build systems enjoyable, but the benefit is that your dev environment is not tightly coupled. If your runtime is also your build system then there’s one tool doing two jobs. Some people might like this. I personally think that this kind of coupling causes more inconvenience over the long-term even if there’s less inconvenience up front.
Focus Group (Tolkien)
That's a nice idea and it kind of works with the internal database. But in terms of FFI or other interactivity, you can't un-read bytes from an input stream or un-write to another process.

That makes interoperability inherently imperative.

My use case is, that you usually wouldn't un-move a robot. You want to re-plan from the current position, if an obstacle comes up. You sure as hell don't want to backtrack into an alternate plan from your original starting position.
If we want space tech that was here and then disappeared: manned missions to the moon. And after retiring the Space Shuttle, the US even lost the ability to put people into orbit until SpaceX came along.

Of course that's all really about money and not knowledge, but that's true for all recently disappeared tech: it just wasn't economically viable.

For tech that has actually been forgotten, you have to go back to Roman self-repairing underwater concrete.
Hey everyone,

I wanted to share an exciting tool I came across called GetMax. It's an AI-powered assistant designed specifically for content marketing. GetMax addresses common challenges in the field, including idea generation, content scheduling, writing, and editing. Think of it as your personal AI assistant, streamlining your content marketing workflow.

Although GetMax is still in development, they're currently building a waiting list for early access. If you're interested in exploring AI solutions for content marketing, I recommend joining the waiting list at https://www.getmax.ai/.

I'm curious to know if anyone else has been exploring AI tools for content marketing. Share your thoughts and experiences—I'd love to hear them!
SSRF in an application is a serious issue to have on its own, that's true, but in combination with a Caddy admin endpoint it can be used to give an attacker full access to your local network.

You could have a blind SSRF vulnerability in an application and while that's not great, it is difficult for an attacker to exploit successfully.

If the attacker knows or guesses you're hosting Caddy on the same machine, they know you most likely have an admin interface on localhost:2019 that they can use to make further local network requests and also makes it possible for them to access the results of their local network requests they were making through the blind SSRF vulnerability hypothesised above.

Basically, if you're not using it (and you shouldn't be using such functionality on a production machine), then you don't need it and should disable it, see: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
Debatably, as language rewrites can bring their own problems. Especially with a newer language like Rust that lacks experienced eyes to review. You get more benefit rewriting the bluetooth drivers in their current languages.
Even simpler: you send out self-replicating AI drones in advance—to every star in the entire galaxy. That guarantees permanent security. The drones assess if alien intelligences have any potential to become a threat, and if so annihilates their planet, by autonomous decision.

Takes a few million years to set up... but that's just a blink of an eye on cosmic time scales; a brief era in the galactic-scale lifespan of an advanced civilization. (The civilizations that don't do something like this don't live that long).
I don't think anything in this incident pointed to a hardware fault

The software raised an exception because a "// TODO: this should never happen" case happened

A hardware fault would look like machines not talking to each other or corrupted data file unreadable
I can’t say I understand all the implications, but would something like Stellar not be more suitable for small amount payments ?

I mean his with regards to speed of the transaction and energy consumption.
Maybe a related question, but how good a proxy is cuff pressure for a gold standard method that measures inside an artery? Whenever I've had BP measured for clinical studies (not focused on BP specifically) they used a mix of cuff and continuous fingertip sensors depending on the activity.
indeed! I also don't dig my own well every time i wish to boil water for tea!
I wouldn't say it's alpha quality at this point. It's running "in-production" on all Asahi Linux laptops.
Maurizio Cimadamore, the project Owner, recently did a presentation on Project Panama (this JEP) during the JVM Summit 2023 - https://www.youtube.com/watch?v=kUFysMkMS00

This JEP will be in preview in Java 21 and the plan is to finalise it by Java 22. So it will be another ~2 years until it is part of an LTS release.
Well if you want to get all nationalistic, the software was Austrian.
I think the backlash against Google Glass set back the interest in wearable computing. I haven't heard about Steve Mann in a while either.
Most large transformers are actually unique but this has little to do with the characteristics of the transformer. It is mostly to do with optimizing the design to minimize the total lifetime cost. This requires a new design for each transformer because the relative prices of core steel and copper or aluminium varies over time. When copper is cheap the total cost will be lower if you use more copper and less core steel for instance while the opposite will be true if the copper price is high.

If cost is not as important as prompt delivery the manufacturer can often just take an existing design and repeat it.
The underlying tech isn't dead but in the 90s I remember reading article after article about how ramjets and scramjets were going to change air travel forever any day now. That day still hasn't arrived and I doubt it ever will.
Why not aim an antenna at it, and download the answers to the questions of the universe?
Yeah it seems clear from the report that NATS published it wasn't a bad flight plan at all... the plan was valid to the relevant specifications

But the specifications allow ambiguities (non-unique waypoint ids) and the software did not handle this particular ambiguity correctly
I co-founded a vanity e-mail provider around 2000, and we 1) registered about 60,000 domains that we provided e-mail for, and we never had problems like that despite tens of thousands of those domains being with then-obscure ccTLDs, 2) a bit later launched the .name top-level domain, and for that we had some very limited initial teething problems because people back then still stupidly used regexes that assumed tld's could only be 2-3 characters. Aside from that it was not a problem, and it resolved itself more than 20 years ago.

I'n the 25+ years of having my own personal domain this has never been an issue for anything but really obscure TLDs unless your mail host fails to stay off blacklists.

With respect to saying it out loud, I occasionally have to repeat my e-mail address once, but that's usually all it takes; we must be dealing with very different people.
Then it means that, yes, you accept being tracked to browse the web a bit faster.

Imagine the situation: your computer is slow and someone promises you to make it faster in exchange of knowing everything about what your computer is doing. Would you accept?

Well, you did.

I’m not pointing the finger at you. We are all doing compromises. I’m just saying that if you don’t want to be tracked but want all the benefits of being tracked then, really, you want being tracked.

Also, Firefox being slow on Android doesn’t seem mandatory (it works really well for me). The fact that you didn’t look to solve this issue is yet one more confirmation that, yes, you agree to be tracked.

Making choices is about the sacrifices we are ready to make for that choice. If there’s no sacrifice, there’s no choice.
This is the reason. Too often I will go to a site and find that it's unusable with Firefox.
What is a MUA? All results consider it "makeup artist."
I'm currently reverse proxying a few docker containers with nginx. Caddy seems tempting but one dealbreaker I can't find in the docs is whether or not it automatically refreshes its DNS cache if a docker container restarts and changes its IP address?

e.g. In nginx, I use "resolver 127.0.0.11 valid=30s" so "proxy_pass {container}:80" will only cache the {container}'s IP address for 30s
Battery was detached from the vehicle??

Are people trying to steal battery packs now, then? - for what other reason would a detached battery be lying next to vehicles in a car park?

(I've always thought that EV battery packs should be standardised, with several easy-ish to replace/upgrade modules per car. But if they make up half the value of the vehicle or so, they also need to be very theft-resistant...)