ArchOversight · HackerTrans

ArchOversight

no profile record

Submissions

Change license from BSD-3 to dual RSALv2+SSPLv1

github.com

13 pointsby ArchOversightil y a 2 ans4 comments

comments

il y a 3 moisdiscuss

Do you have more information on this?

il y a 4 moisdiscuss

It's not that it's that complex to need all of this. It's about ease of use. Home Assistant OS makes life simpler for users (such as myself), it makes it easy to use adding that run as additional docker containers, it makes plugging in USB z-wave/zigbee devices a breeze.

While it is technically no longer supported, you can still install the whole kit and caboodle using pip in a Python virtual environment, but why would you?

il y a 4 moisdiscuss

https://www.home-assistant.io/installation/generic-x86-64/

you mean an image like this?

This is what I've been running on my generic x86-64 system for a couple of years now, 0 issues. Even migrated to a newer system recently because I wanted something that was slightly faster for ESPHome compilations.

il y a 5 moisdiscuss

The insurance companies primarily... secondary the people with bombs that can sink ships attempting to use the waterways.

il y a 9 moisdiscuss

That's why Matter and Thread are IPv6. You don't need IPv4 at all... and if you run out of IPv6 address space, I'd love to see just how many devices/sensors you have in your home.

il y a 9 moisdiscuss

Which sellers? I have been looking for custom ones because I have some weird window sizes.

il y a 9 moisdiscuss

https://archive.is/eWcpP

il y a 11 moisdiscuss

FedEx in my case paid the bill to customs, shipped me my item, and then secondary sent me a bill to pay for the customs fees after I had already received the item.

They don't want shipments stuck in port because storage there is expensive.

il y a 11 moisdiscuss

That assumes the server has a lot of additional CPU power to serve the content as HTML (and thus do the templating server side), whereas with XSLT I can serve XML and the XSLT and the client side can render the page according to the XSLT.

The XSLT can also be served once, and then cached for a very long time period, and the XML can be very small.

il y a 11 moisdiscuss

If this is the reason to remove and or not add something to the web, then we should take a good hard look at things like WebSerial/WebBluetooth/WebGPU/Canvas/WebMIDI and other stuff that has been added that is used by a very small percentage of people yet all could contain various security bugs...

If the goal is to reduce security bugs, then we should stop introducing niche features that only make sense when you are trying to have the browser replace the whole OS.

il y a 11 moisdiscuss

Sounds like libxslt needs more than just a small number of fixes, and it sounds like Google could be paying someone, like you, to help provide the necessary guidance and feedback to increase the usability and capabilities of the library and evolve it for the better.

Instead Google and others just use it, and expect that any issues that come up to be immediately fixed by the one or two open source maintainers that happen to work on it in their spare time. The power imbalance must not be lost on you here...

If you wanted to dive into what [3] does, you could do so, you could then document it, or refactor it so that it is more obvious, or remove the compile time flag entirely. There is institutional knowledge everywhere...

il y a 11 moisdiscuss

Even if you provide a phone number, it will never send the required code or information and you will still be locked out of your account.

That is how I am locked out of a gmail account... eventhough I have the right username/password, and backup email, and typed in a phone number, Google won't let me back in.

l’année dernièrediscuss

The code would have failed because you can't use an uninitialized variable, so you would have had to set it to a default. You don't just get random garbage from the stack.

l’année dernièrediscuss

On MacOS it has a larger net mask, but the OS doesn't respond to any address within that range automatically.

  lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
   options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
   inet 127.0.0.1 netmask 0xff000000
   inet6 ::1 prefixlen 128
   inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
   nd6 options=201<PERFORMNUD,DAD>

l’année dernièrediscuss

You believe that Hector Martin is also Asahi Lina?

https://bsky.app/profile/lina.yt

https://github.com/AsahiLina

l’année dernièrediscuss

Is there going to be a way to turn FIPS on as a requirement without having compiled the binary against the FIPS-140 module?

Even now it has been a lot of trouble trying to get vendors to provide us a way to rebuild/repackage their Golang binaries using the FIPS-140 support from RHEL, and if it is still the case that they need to build one-offs, teams will still need to rebuild/repackage a lot of Golang tools just to be FIPS compliant because it's not as simple as setting a flag like it is for OpenSSL.

l’année dernièrediscuss

Most projects that compile against OpenSSL can be forced into FIPS mode by setting a flag that the OpenSSL library uses to force enable FIPS mode when it is loaded.

Golang projects however don't compile against OpenSSL instead using the internal cryptography. In many cases rebuilding and repackaging a Golang based tool is a no-no since now you are accepting ownership of it in an audit, when instead you want to point to an upstream vendor, or source code is not available.

So in many cases in production while the system itself is in FIPS mode (Linux kernel), and applications using system crypto libraries (OpenSSL primarily) are in FIPS mode, Go binaries are not in FIPS mode and may end up using algorithms that are explicitly disallowed by the FIPS standards.

l’année dernièrediscuss

Either projects start shipping FIPS enabled or companies have to rebuild and repackage projects with FIPS enabled.

With OpenSSL installed system wide you can turn on a flag and the library will force it into FIPS mode internally, with Go unless you build your binaries to link against OpenSSL like this Microsoft Go release seems to be doing you don't get that instant on system wide.

il y a 2 ansdiscuss

Op uses they/them pronouns.

il y a 2 ansdiscuss

Author uses they/them pronouns.