champtar
Re:BunnyCDN has been silently losing our production files for 15 months
on Thursday April 09, 2026 @09:57PM (#47712682)
There is also OVH (not affiliated, just happily using their VPS), but I would consider switching to 2 providers, as any provider can have data loss or just lock your account at anytime for any reasons. 2 providers with free egress so you can easily replicate data between them.
Re:Flash media longevity testing – 6 years later
on Monday March 09, 2026 @04:50PM (#47315336)
TIL `badblocks -t random` repeats the same random block over and over :(
Re:New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and...
on Thursday February 26, 2026 @05:57PM (#47173313)
Just being able to inject traffic is already huge as it allow you to send IPv6 router advertisement, which sometimes allows you to change the DNS config
Re:RCE via ND6 Router Advertisements in FreeBSD
on Thursday December 18, 2025 @02:10PM (#46317123)
You need working switch level filtering, many implementations can be bypassed / will never be fixed: https://blog.champtar.fr/VLAN0_LLC_SNAP/
Re:Rootless Pings in Rust
on Tuesday December 02, 2025 @06:52AM (#46120338)
CAP_NET_RAW also allow to capture packets (tcpdump) so you really can have some fun like running a TCP stack in user space or MITM http connections: https://blog.champtar.fr/IPv6_RA_MITM/ / https://blog.champtar.fr/Metadata_MITM_root_EKS_GKE/
Re:RediShell: Critical remote code execution vulnerability in Redis
on Monday October 06, 2025 @08:36PM (#45498016)
Good news that it was found and fixed, but 140 days response time seems rather slow for such a critical vulnerability
Re:OpenWrt: A Linux OS targeting embedded devices
on Monday September 08, 2025 @01:38PM (#45171271)
Curious what are the main benefits ? (I've only ever used DD-WRT and OpenWrt)
Re:I Ditched Docker for Podman (and You Should Too)
on Friday September 05, 2025 @06:08PM (#45144228)
In OpenWrt there is ujail, you give it an ELF (or multiple) to run, it'll parse them to find all the libraries they need, then it creates a tmpfs and mount bind read only the required files.
https://github.com/openwrt/procd/blob/dafdf98b03bfa6014cd94f...
Re:Don't pick weird subnets for embedded networks, use VRFs
on Sunday August 24, 2025 @04:55PM (#45007682)
2 big address block that have few chances of conflict:
- CGNAT 100.64.0.0/10
- "Benchmark" 198.18.0.0/15
Re:Debian 13 "Trixie"
on Saturday August 09, 2025 @09:55PM (#44852166)
It'll not, the new behavior is just a new naming scheme, and you just choose not to use any, which is totally fine if you have a single NIC.
Re:Debian 13 "Trixie"
on Saturday August 09, 2025 @08:45PM (#44851800)
You can easily keep the current naming behavior with the 'net.naming_scheme=' kargs
Re:Debian 13 "Trixie"
on Saturday August 09, 2025 @07:54PM (#44851482)
Hopefully the last breaking change.
enoX should always stay stable, as it's the BIOS (in some ACPI table) telling that this device/port has this ID.
ensX means the NIC in PCIe slot X, but in your PCIe tree you can have PCIe bridges, so technically you could have multiple NIC in the same slot (what the BIOS declare as a slot), so there was a lot of breaking NIC naming changes over the years in systemd to figure out the right heuristics that are safe, enabling/disabling slot naming if there is a PCIe bridge, but just in some cases.
Also for historical reasons the PCIe slot number was read indirectly leading to some conflicts in some cases (this was fixed in systemd 257)
Re:Never write your own date parsing library
on Friday July 25, 2025 @06:45PM (#44689379)
I once had to maintain a CalDAV server that was developed in house, computing the "free busy" with recurring events, exceptions, different timezone than the organizer + some DST is a bug source that keeps on giving.
Re:BorgBackup 2 has no server-side append-only anymore
on Sunday June 08, 2025 @06:12AM (#44215964)
https://github.com/rustic-rs/rustic?tab=readme-ov-file#stabi...
rustic currently is in beta state and misses regression tests. It is not recommended to use it for production backups, yet.
Re:BorgBackup 2 has no server-side append-only anymore
on Saturday June 07, 2025 @05:11PM (#44212698)
If you want to use some object storage instead of local disk, rclone can be a restic server: https://rclone.org/commands/rclone_serve_restic/
Re:How I got a Root Shell on a Credit Card Terminal
on Monday June 02, 2025 @02:07AM (#44156169)
I remember when contactless was introduced in France, someone from the CB bank card group (https://en.m.wikipedia.org/wiki/CB_Bank_Card_Group) said that contactless was secure because you are insured. At that time France was already using chip+pin for a while.
At the end of the day the money only goes from one bank account to another, account can be frozen, charge reversed, ... So you just need to secure the POS enough that user feel safe to use it and there is a low number of people that can hack them and are willing to risk prison.
Re:Why Top Posting Has Won
on Sunday May 25, 2025 @02:45PM (#44089941)
If you are using Microsoft Outlook mobile app or the webmail, inline or bottom posting experience is garbage, it doesn't quote/format the previous email, it just slaps it at the bottom. If you want to respond inline you better put some color else it's unreadable.
Re:Proposal: Add bare metal support to Go
on Wednesday May 07, 2025 @07:10PM (#43921424)
For timezones data go already has https://pkg.go.dev/time/tzdata
Re:It is no longer safe to move our governments and societies to US cl...
on Sunday February 23, 2025 @04:44PM (#43153505)
AWS EBS volumes (except io2) have an annual failure rate of 0.2%, so if you have 1000 running statistically you will loose 2.
For io2 it's 0.001%, but still not 0.
Re:A tale of several distros joining forces for a common goal: reprodu...
on Saturday February 08, 2025 @11:19AM (#42983987)
With reproducible build you know that what you test on your dev laptop is the same as what will go out from your CI, and if hash mismatch you can chase why. For a concrete exemple, Mellanox driver configure script will auto detect if it's running under docker and change a compile flags, so if you build in a container using podman you get a different result.
Re:We use our own hardware at Fastmail
on Sunday December 22, 2024 @10:03PM (#42491351)
All EBS volumes except io2 have advertised durability of 99.8%, which is pretty low, so don't count it in the magic networked storage category.
Re:We use our own hardware at Fastmail
on Sunday December 22, 2024 @09:19PM (#42491132)
You can securely store your asymmetric key for signing, but if I remember correctly the logs are pretty useless, basically you just know the key was used to make a signature, no option to log the signature or additional metadata, which would help auditing after an account/app compromise.
Re:OpenWrt Community question: What do you want to see in OpenWrt?
on Wednesday November 27, 2024 @06:25PM (#42260836)
Well TOTP need proper time sync, and most routers don't have battery in them
Re:OpenWrt Community question: What do you want to see in OpenWrt?
on Wednesday November 27, 2024 @02:23PM (#42258873)
u2f and webauthn require https (https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...), don't know if it accepts self signed certs and IPs instead of fqdn. Also the auth is locked to the host, so if you use IPs, changing IP means you need to remove 2fa first and re-enroll after. IMO just using a 60+ chars password stored in your password manager + moving the admin access in a separate vlan is simpler and enough.
Re:serverless-registry: A Docker registry backed by Workers and R2
on Thursday September 05, 2024 @07:44PM (#41461415)
Both exemples generate custom nginx config
Re:serverless-registry: A Docker registry backed by Workers and R2
on Thursday September 05, 2024 @02:41PM (#41459357)
I would love if the container pull protocol stopped using custom headers or content-type, so we could use any dumb http server.
Re:Using S3 as a Container Registry
on Friday July 12, 2024 @08:27PM (#40950710)
What I would really love is for the OCI Distribution spec to support just static files, so we can use dumb http servers directly, or even file:// (for pull). All the metadata could be/is already in the manifests, having Content-Type: octet-stream could work just fine.
Re:It's official: ADSL works over wet string
on Friday May 17, 2024 @08:23PM (#40395464)
Sewer are properly buried, Rogers cables are just thrown around with maybe a bit of dirt on top of it was a good day.
I redid a wall in my backyard last year that is close to a Rogers box, I removed ~15 old cut cables from the ground.
Re:Attackers Can Decloak Routing-Based VPNs
on Monday May 06, 2024 @10:20PM (#40281647)
I invite you to not trust blindly L2 security features, anything that use denylist approach can miss some corner cases, have a good read :) https://blog.champtar.fr/VLAN0_LLC_SNAP/
Re:Attackers Can Decloak Routing-Based VPNs
on Monday May 06, 2024 @10:09PM (#40281573)
You should play with IPv6, you can bypass IPv6 RA Guard on some switches (including Cisco) https://blog.champtar.fr/VLAN0_LLC_SNAP/, allowing attacks in 'trusted' networks