If you use openssh with musl without PAM and have password authentication enabled, there are two things you did wrong:

• having password authentication enabled
• using openssh

breathes a sigh of relief in tinysshd

Every commercial mail service is enshittifying.

Most FOSS MTAs are, too. And self-hosting is extremely difficult because the requirements placed on senders in order to interoperate with that hellish jungle of providers without getting flagged as spammers by scam blocklists become more stringent every year.

It looks like the OS ecosystem is going to enter a phase of diversification as we desperately try to rebuild from the bits and scraps that are surviving the AIpocalypse. That means that in the near future, it's going to be important to have software that focuses on interoperability and protocols, and less on details of a system.

The path Linux is taking is considerably diminishing my interest in the Linux-specific plans I had: s6 extensions to handle cgroups, dbus replacement, PAM replacement (which I'm not entirely giving up on yet because other OSes need a better authentication framework too). I find myself looking at fundamentals and RFCs again.

Even what I have been working on this past month - sdcl, which I may talk about more in the future - does not feel as important anymore, because it's about interoperability of service managers, which is a good idea, but not necessarily what we need the most right now.

For the longest time I have asserted that I was not getting into the MTA world, but given the speed at which the ecosystem is deteriorating, I find myself questioning my assumptions and wondering about things that did not make any sense even six months ago.

Is it time for qmail 2 ?

RE: https://social.treehouse.systems/@ska/117370802975687393

Since there is a cj thread about Fabrice Bellard at the moment: I don't want to rain on anyone's parade, or make people think I'm a hater, or jealous or anything (seriously, I'm not: I don't want what he has, and I have what he cannot) so I'm not going to intrude there, but I think some things deserve reminding.

RE: https://mastodon.social/@iris_meredith/117187854880278641

this "security issue" is pretty hilarious ngl

For no particular reason I felt inspired to make this creative work of art, and release it as is in the public domain with no product attached to it; it is not an endorsement or advertising of anything. If you decide to use it, please make sure to comply with the license of the logos this picture is using.

Just advertising today for no particular reason at all:

s6 is a process supervision suite, written in C, that can easily be turned into a complete init system, and that works out of the box on every remotely POSIX-compliant system, no matter the kernel, and that can probably be made to work really easily on any new Unix-inspired OS that would be published.

s6 comes with its own service manager, s6-rc, and it can also work in conjunction with OpenRC.

The whole s6 ecosystem is made by humans, for humans (and for computers as well, but computers are meant to serve humans). It has never merged a line of LLM-produced or "LLM-assisted" code, and it will never merge a line of LLM-produced or LLM-assisted code.

It moves slow, but it fixes things, and if everything is crumbling around you, it will still be here, and it will help you rebuild. That is what a supervision system does.

@leah Just in case: did you send me a CD, bought on medimops.de, with music from Bach, Telemann, Purcell and Vivaldi performed by Collegium Instrumentale?

Call to contributions

Hey CI/CD Free Software Fedi,

I plan to move the s6-overlay repository away from Github. Probably to Codeberg.

Problem is, the build uses Github Actions, which I'm not fluent in (it was written by @jprjr , thanks again!) - and Forgejo Actions use a different format.

Learning these languages would be way too much time investment from me, for a small benefit.

So I'm asking for help from knowledgeable people. Could someone please take a look at https://github.com/just-containers/s6-overlay/blob/master/.github/workflows/release.yml and convert it to a file that would work on Codeberg's Forgejo? It's a small file, but it uses a build matrix, targeting several architectures.

What would be even more awesome is if Forgejo could create symlinks to artifacts (in order to have the same artifact exposed under several names). That would allow me to work on long-requested features. If not, no big deal.

Thanks a lot!

(Edit: typo)

RE: https://social.lfx.dev/@openssf/116245353632447587

Is this good, chat?

If you know anything about LLM crawlers, you know that most of them are unethical pieces of shit. They want to download all your content, they do not respect robots.txt, and they know they're doing something wrong because they try their hardest to avoid being blocked. They attack you from large swaths of IPs, among which residential ones, so you can't pre-ban IPs or networks. Usual countermeasures to Internet abusers do not work, and that's why alternative solutions like Anubis (https://anubis.techaro.lol/) exist and are widely deployed.

Problem: I can't use Anubis on my setup.

The skarnet.org project is, in a large part, an experiment in building a different software stack, with as little code as possible, and extracting the most possible value for that amount of code. I'm very happy with what I've built so far, but it also means there are limits, and things I cannot do, because it would go against the skarnet.org design entirely. Deploying Anubis is one of these things. 2/8

So, like everyone who hosts a website, I have been spammed by LLM crawlers, and though it hasn't been showing externally - the skarnet.org site was always responsive, which I want to attribute to the light weight of its web stack - it has been significantly annoying for me personally: the server also serves as my development machine, and my builds had slowed down to a crawl. The load average hovered around 26 and could spike to 33 or more. skarnet.org is the smallest possible VPS I could register; it's supposed to be cheap, not powerful - it wasn't meant to support this kind of abusive load. Last month, I decided to finally do something about it. 1/8

(alt text for the image: an email from Disney Plus informing me they're going to raise the price of my subscription.)

Do these people suck at timing and apropos or what

The overused cliché of the teenager being caught masturbating when a parent barges into the room, but with LLM use instead.

Come on, Kevin, you've been talking to ChatGPT again? - it's not what you think Mom I SWEAR