:neobot_bongo_down: new USCSB :neobot_bongo_down:

https://youtu.be/8lkIFYpI0p8

vibe coding is one thing, vibe coding by people who aren’t programmers is so much worse. i’m sure nothing will go wrong when a CEO fires the entire development team just because he thinks he can “do it himself” with claude

on the recent humble bundle stuff: shortcomings of LLMs are only amplified by people who don’t know what they’re doing. LLMs will always make mistakes, and if nobody with subject matter experience actually audits their work and notices them, then guess what? you get this

how about no?

fucking why, GIMP? you never needed this before

don't give your RAM to sam altman, give to me, i'm hungry

another reason why microkernel operating systems are simply better: no need to wait hours to rebuild your entire kernel to swap in a single driver

i could run a single node cluster on one of my other machines, but i need three nodes for ceph, and without ceph my storage options are severely limited

same issue if i try to run new nodes under kubevirt or something, there’s no disks to pass through to the vms because the host disks are already all in use by ceph (and there are no M.2 slots left on the physical servers)

so apparently kubernetes multitenancy is a bad idea and I’m just like, what the fuck do I do. i already spent a ton of money on the existing cluster nodes, i can’t exactly buy three more…

there’s https://www.vcluster.com, but the actually useful features are locked behind a licensing tier, and i’m not really too happy with the idea of relying on a proprietary product

my original idea was to just put the services in seperate namespaces and isolate them with kata containers, but that plan’s useless because they can’t be allowed to talk to the kubernetes api server either

omfg THAT’s how geometry dash renders on the duo???

normal apple books library

just watched Inglorious Basterds for the first time. that cinema scene… chefs kiss

Bravo Tarantino

4

always glad my internal services remain under mTLS and externally behind Pomerium. want to exploit a vulnerability? good fucking luck, you can’t even complete the TLS handshake without a valid client certificate

keeping the gustavo fring vibrating titties gif on standby for when the scambots slide into my DMs

Service provider support continues to sometimes be an issue with E2H and E2D because of authentication. Historically, service providers would require ISPs to “vouch” for the user’s identity by authenticating them on their behalf and then presenting a client certificate to complete the IPsec handshake. Because individuals had no access to ISPs certificates, this posed an issue.

It would eventually be solved by ISPs issuing individual certificates to households and devices, where the devices would generate the private key and send the CSR to the ISP, ensuring the ISP did not keep a record of it. For legacy reasons, some providers still do not “trust” this arrangement, making E2S necessary.

5. ISP PEI initiates IKE Phase Two with service, responding with ICMP NPI OPEN COMPLETE
6. Client can now communicate with remote IPv6 for which the ISP PEI transparently proxies the IPsec SA. Before establishment all packets to the address would have been dropped
7. Client continues to send ICMP NPI KEEPALIVE packets to PEI based on minimum interval in OPEN COMPLETE to keep the tunnel open
8. If the tunnel is closed by the ISP or remote host an ICMP NPI TERMINATED packet is sent to the client

For E2H: the home border router acts as the ISP PEI and point of initiation for tunnels, and clients send ICMP NPI messages to it exactly as with PEIs. For E2D, no ICMP messages are sent and instead the kernel networking stack takes over the role of the PEI internally.

So in my alternate future they decided to go down the path of IPsec for transport security instead of TLS… I wrote about the connection flow

There were three historical standards:
E2S = Encryption to the ISP
E2H = Encryption to the Home
E2D = Encryption to the Device

NPI Enhanced E2S Flow
1. Client looks up hostname of service and determines address and NPI support via DNS
2. Client sends ICMP NPI OPEN packet to ISP PEI (upstream gateway) with IPv6 address of peer
3. ISP PEI initiates IKE Phase One with service; X.509 certificate is returned which includes the network prefix in an extension
4. ISP PEI looks up the ISP issuer of the service’s NPI certificate and validates it against its list of trusted ISP issuers

A lockdown-class blast door (LCBD) is a blast door that is designed to reliably close during a lockdown no matter what obstructions are in its way. This is usually accomplished by linear motors capable of crushing bones and metal alike, sometimes combined with a sharp or serrated metal edge, and/or cleaving forcefields. Because it only minimises and doesn’t eliminate risk, Raven takes a different approach at its sector firebreaks, where it utilises blast doors in an airlock configuration where at least one door remains closed and locked at all times.

it’s always some “high crime” area like atlanta and people are always shooting at me