A password manager is the one thing I'm very skeptical to use SSO for.
It's most useful for companies, where the goal is as much SSO as possible.
Readit Newswazzaps commented on Vaultwarden commit introduces SSO using OpenID Connect github.com/dani-garcia/va... · Posted by u/speckx
finally feels like Python scripts can Just Work™ without a virtualenv scavenger hunt.
Now if only someone could do the same for shell scripts. Packaging, dependency management, and reproducibility in shell land are still stuck in the Stone Ages. Right now it’s still curl | bash and hope for the best, or a README with 12 manual steps and three missing dependencies.
Sure, there’s Nix... if you’ve already transcended time, space, and the Nix manual. Docker? Great, if downloading a Linux distro to run sed sounds reasonable.
There’s got to be a middle ground simple, declarative, and built for humans.
Check out mise: https://mise.jdx.dev/
We use it at $work to manage dev envs and its much easier than Docker and Nix.
It also installs things in parallel, which is a huge bonus over plain Dockerfiles
wazzaps commented on Catalog of Novel Operating Systems github.com/prathyvsh/os-c... · Posted by u/prathyvsh
wazzaps commented on 'Impossible-to-hack' security turns out to be no security jltee.substack.com/p/new-... · Posted by u/DeLopSpot
Is it hacking when there is no "breach?"
If I serve a file with info I didn't intend for the world to see at example.com/secret and you access it, did you commit a crime? Clearly no.
Given that, you have no way to even know if the data which was available publicly contained any private information. This guy is doing a fine public service, and any company he helps should pay him for saving their asses.
You can still get dragged to court for it[1], even if you may (eventually) win, lawyers are expensive.
[1]: https://techcrunch.com/2021/10/15/f12-isnt-hacking-missouri-...
wazzaps commented on Ask HN: Have you ever seen a pathfinding algorithm of this type? blog.breathingworld.com/r... · Posted by u/Farer
I wrote a similar algorithm for pathfinding around vector shapes in Javascript, the implementation was surprisingly simple.
wazzaps commented on The Ugly Truth About Spotify Is Finally Revealed honest-broker.com/p/the-u... · Posted by u/LordAtlas
What is YT premium and why would you pay money to use YT? It's the best free service that still exists if you have an adblocker. A lot of content has baked in ads now, but you can skip or just view something else.
I've learned what Youtube Premium is: "YouTube and YouTube Music ad-free, offline, and in the background"
For me, that's nothing as I can already view with no ads, and download whatever I want.
It also includes 256kbps AAC audio (vs 128kbps for free users).
wazzaps commented on Syncthing Android App Discontinued forum.syncthing.net/t/dis... · Posted by u/opengears
wazzaps commented on Microsoft technical breakdown of CrowdStrike incident microsoft.com/en-us/secur... · Posted by u/nar001
> Crowdstrike already runs in user-mode on both Mac and Linux (from what I can tell),
Crowdstrike provides a Linux kernel module, and expects users to manually install an extra Secure Boot key for it, as part of their corporate laptop setup procedure.
This has always seemed inadvisable to me, but checkbox checkers gotta check checkboxes I guess.
They also support (and recommend I think?) an eBPF-based sensor
wazzaps commented on Initial details about why CrowdStrike's CSAgent.sys crashed twitter.com/patrickwardle... · Posted by u/pilfered
I wrote this in another thread already, but the fuck up was both at crowdstrike (they borked a release) but also and more importantly their customers. Shit happens even with the best testing in the world.
You do not deploy anything, ever on your entire production fleet at the same time and you do not buy software that does that. It's madness and we're not talking about small companies with tiny IT departments here.
Apparently CrowdStrike bypassed clients' staging areas with this update.
Source: https://x.com/patrickwardle/status/1814367918425079934