News for hackers. Stuff that matters.

_yy

Re:Dokan – User Mode File Systems on Windows on Wednesday April 06, 2016 @06:14AM (#11437812)
Wait, what?

What happened? :( I really liked that service.

Re:Apricity OS: A Beautiful Arch Linux Distro on Monday April 04, 2016 @11:17AM (#11422519)
Sure, but, meh. A few dozen RAW picture files take more space.

Storage is cheap nowadays and KDE applications generally are of such high quality that it's definitely worth it.

Other examples are Digikam (hands-down the best picture organizer) and Krita (which rivals Photoshop for digital artists).

Re:Dokan – User Mode File Systems on Windows on Monday April 04, 2016 @11:10AM (#11422451)
Wuala is using it, too.
Re:Apricity OS: A Beautiful Arch Linux Distro on Monday April 04, 2016 @06:01AM (#11420584)
There's Antergos for this.
Re:Apricity OS: A Beautiful Arch Linux Distro on Monday April 04, 2016 @05:59AM (#11420573)
It's indeed strange and definitely against the spirit.

There's an excellent open source project which does this and much more: https://play.google.com/store/apps/details?id=org.kde.kdecon...

Re:Apricity OS: A Beautiful Arch Linux Distro on Monday April 04, 2016 @05:58AM (#11420565)
Fedora is the only real alternative if you want more stability.
Re:Apricity OS: A Beautiful Arch Linux Distro on Monday April 04, 2016 @05:57AM (#11420559)
You don't even need NixOS for that. Just use Ansible or Puppet to manage your Arch Linux configuration.
Re:StartSSL domain validation vulnerability on Tuesday March 22, 2016 @07:37AM (#11335738)
RapidSSL does it too.
Re:Show HN: Miaou, an OS chat for developers and gamers on Friday March 18, 2016 @12:38PM (#11312941)
The reason all of those incompatible chat protocols pop up is that all of the popular federated protocols lack features like inline image transfer, a usable backlog, persistence, live previews or gimmicks like code formatting and editing and third party integrations.

People want those, and value them enough to give up federation.

My personal favorite is Zulip, by the way: https://zulip.org/

Its threaded conversation model really helps with ignoring discussion about topics you're not interested in. When I get back to an IRC/Slack/whatever channel, I spend quite a while catching up. 99% of the conversation does not concern me, yet I have to read it. Zulip's threading is a great solution to this.

Re:CocoaPods downloads max out five GitHub server CPUs on Tuesday March 08, 2016 @12:20PM (#11246704)
Wow, this is pretty cool. Reminds me of the performance optimizations Facebook has done with Mercurial: https://code.facebook.com/posts/218678814984400/scaling-merc...

Mercurial was designed to be easy to extend, and it shows.

Re:Power Wastage on an Idle Laptop on Tuesday March 08, 2016 @12:04PM (#11246568)
The estimates may be off, but the raw data it reports (context switches, wakeups etc.) is accurate.
Re:Let's Encrypt has issued its first million certificates on Tuesday March 08, 2016 @10:00AM (#11245572)
> What if your cronjob doesn't fire? What if LEs script has a bug and you're not up to date?

That's why I renew them a week in advance. I set up Nagios checks which alert me when a certificate is not renewed. Those were already in place before LetEncrypt since human error is just as likely as a script breaking.

Re:MSYS2: Arch Linux on Microsoft Windows on Thursday March 03, 2016 @08:21AM (#11216649)
Does it support hardening flags by now? (ASLR etc.)
Re:The DROWN Attack on Tuesday March 01, 2016 @11:30AM (#11203765)
Other protocols are probably just as broken, we just haven't found the vulnerabilities yet. Few protocols (if any) get as much scrutiny as SSL/TLS.
Re:The DROWN Attack on Tuesday March 01, 2016 @11:12AM (#11203594)
The NIST curves also have constants which may or may not be manipulated.

Bruce Schneier recommends against using them.

Re:Slack, I’m Breaking Up with You on Monday February 29, 2016 @10:58AM (#11196173)
Zulip (https://zulip.org/), a recently open-sourced Slack alternative, has a clever solution for this. They have a light-weight threading model which ensure that discussions stay within context. That way, you can just ignore discussions about topics you're not concerned with without missing anything else. It's great.

> Sometimes, important things get discussed when you’re not around. Unfortunately, so do a lot of unimportant things.

> Zulip makes it easy to review the conversations you missed, so you can focus on that important project without having to catch up on how Jim’s guitar lessons are going.

Someone on HN described it very well:

https://news.ycombinator.com/item?id=10281065

Re:Dear Skype/Microsoft: Problems with Linux client on Wednesday February 24, 2016 @05:13AM (#11165677)
Google Hangouts is a great alternative. It only needs a browser, too.
Re:Distribution packages considered insecure on Tuesday February 23, 2016 @10:16AM (#11159406)
> I didn't have any update-induced downtimes yet, except for the usual reboots to apply kernel upgrades

Wait until the first major backwards-incompatible config format change breaks something. Puppet was one example of many.

> My solution is to package that software myself in a private repo, so that I get to decide when to upgrade.

Works fine for single applications, breaks horribly for system-wide shared libraries.

Re:Linux Mint downloads (briefly) compromised on Monday February 22, 2016 @11:25AM (#11151934)
> I remember not long ago Mint included just about every browser media plugin ever made, including RealMedia, WindowsMedia etc., stuff that was obsolete 15 years ago. Maybe it still does.

Weren't those just VLC wrappers?

Re:Distribution packages considered insecure on Monday February 22, 2016 @11:11AM (#11151793)
Your project reminds me of 0install.
Re:Distribution packages considered insecure on Monday February 22, 2016 @11:08AM (#11151766)
> WP has the ability to use (S)FTP to update the files rather than direct file access.

Well that doesn't help at all with security.

Re:Distribution packages considered insecure on Monday February 22, 2016 @11:06AM (#11151735)
This is exactly what any company using Debian in production does.
Re:Distribution packages considered insecure on Monday February 22, 2016 @11:04AM (#11151716)
> testing is Debian's rolling release.

Except for when it freezes.

Re:Distribution packages considered insecure on Monday February 22, 2016 @11:02AM (#11151701)
> It's just in the same bag as Gentoo regarding release process.

There's a big difference, though - Arch Linux has no concept of partial upgrades. You have to update, or things break. Gentoo allows you to stick with old versions and has a pretty sophisticated mechanism for that ("slots"). It's also complicated, which is one of the reasons Arch Linux is easier to use.

This makes Arch Linux unsuitable for pretty much any "production" scenario. Puppet version updated to 4? Tough luck if you didn't scramble and update all of your code since version 4 has backwards-incompatible changes.

Works pretty well for desktops - if something breaks, you can usually just fix it. But it does not scale.

Gentoo, on the other hand, has an unstable and a "stable" channel and you can use it for production systems if you've got the necessary manpower to essentially build your own distro.

Re:Distribution packages considered insecure on Monday February 22, 2016 @10:56AM (#11151645)
> That's when enterprises might start considering moving onto that version, so the incentives aren't really aligned here.

Easier said than done in many environments. RHEL 6, released in 2012, is still supported until 2017!

Re:Distribution packages considered insecure on Monday February 22, 2016 @10:44AM (#11151540)
That's certainly a risk, but it's less likely to happen than the alternative and all serious distributions have a QA process in place which is designed to catch those issues.
Re:Distribution packages considered insecure on Monday February 22, 2016 @10:30AM (#11151428)
The author also seriously recommends Arch Linux and Tumbleweed as alternatives. Anyone who ever maintained a server in an enterprise production environment knows how valuable the kind of stability that the author criticisms is. Not everyone lives in a DevOps environment where you can "move fast and break things".

He does have a point about unmaintained packages, though. Debian probably shouldn't package things if they cannot support it over the lifetime of the release. Why would I ever want to use a two-years-old Wordpress version? I never understood why those kinds of applications are even packaged at all.

Most sysadmins deal with this by including a third party repository for applications and Elasticsearch (any many others), often by the authors themselves, which takes care of security and version updates. This eliminates most of the concerns. You get a rock-solid operating system and an up to date application on top of it. Web applications like Wordpress or Owncloud aren't usually deployed using distro packages at all.

Re:Distribution packages considered insecure on Monday February 22, 2016 @10:22AM (#11151357)
Nah, that's why packaging web apps with a stable Linux distribution is a notoriously bad idea and should be discouraged.

Debian (and other distros) do a perfectly fine job updating the actual operating system.

Re:Linux Mint downloads (briefly) compromised on Monday February 22, 2016 @09:26AM (#11150945)
It's easily the most secure Linux distro. It has SELinux enabled by default (and it actually works!) and compiles binaries using most of the available hardening features, other than basically any other mainstream distro.

They have an excellent testing/QA process, especially given the speed at which they're developing - this results in a very high quality.

Re:Linux Mint downloads (briefly) compromised on Monday February 22, 2016 @09:23AM (#11150923)
All of the Linux Mint application work well on Arch Linux (Cinnamon, Mate), too!

Older »