Posts by AnachronistJohn@zia.io
(DIR) Post #B44JlhmueNNumY6Koa by AnachronistJohn@zia.io
0 likes, 1 repeats
Here’re some pictures from #NetBSD at SCALEThere’s a lot of interest in NetBSD :)First is a Raspberry Pi 400 with ctwm running as a stratum 2 NTP server. Our neighbors just happen to be the Network Time Foundation.@socallinuxexpo
(DIR) Post #B4SAq0C3vN49EMsR5k by AnachronistJohn@zia.io
0 likes, 1 repeats
@jns @rl_dane #NetBSD has a careful and deliberate developer selection, so the scenario where lots of corporate shills come in, invite more corporate shills, then push out or outnumber non-shills won’t happen.It’s not a coincidence that we’re not making bullshit excuses to de-support x86 and lesser known architectures, and that we’re not allowing “AI” anything.
(DIR) Post #B4SFGjsX5gkUGYkMYy by AnachronistJohn@zia.io
0 likes, 1 repeats
@rl_dane @jns Some Debian developer who is also paid by a megacorp wrote about how supporting big endian and 32 bit are are too hard and incur too much “maintenance” work.Obviously, saying that is just saying that he’s a shitty programmer, but really, it’s an excuse for corporations to push Debian towards not supporting stuff that doesn’t directly support corporations.That’s an oversimplification, but in a nutshell, Debian is being led by corporate shills. This is how I feel about systemd, too - it seems to prioritize server use above everything else, not infrequently to the specific detriment of other use cases.
(DIR) Post #B4SFZUW4Qooc7gBLW4 by AnachronistJohn@zia.io
0 likes, 0 repeats
@rl_dane @jns @mirabilos macOS is actually coming out as the least shitty of all options these day.Most people use computers for pre-packaged stuff like Zoom, video editors, browsers, et cetera, and an appliance with excellent hardware integration works very well for those uses, whereas open source OSes don’t.I can run stuff like that in VMs on my open source OS of choice (NetBSD), but I can’t get GPU acceleration because of the proprietary nature of GPUs and their drivers.So if I’m going to have some proprietary stuff, like GPU drivers from a big, evil company that acts like a monopoly, then why not just choose a proprietary device like a Mac that 1) has fewer problems and better battery life, 2) is openly antagonistic to the other huge, shitty corporations?I’m not a fan of many things about Apple, but are they more secure than Windows? Yes. Are they less shitty, less problematic and less pricey than NVIDIA? Yes. Can I open a shell and run whatever VMs I want? Yes. Is it ideal? No, but nothing else right now is closer.
(DIR) Post #B4aOTqyAUYHUsIOGbg by AnachronistJohn@zia.io
0 likes, 0 repeats
@Em0nM4stodon I have, yes. People who are security conscious either already have Signal or are willing to install and use it.OTOH, I’m not happy at all that my account must be tied to a phone number. I’ve given up all uses of old fashioned phone numbers, and it’s a shame that Signal has no way around that.
(DIR) Post #B51h2hYQX8E0Fi2DCK by AnachronistJohn@zia.io
0 likes, 1 repeats
@Sustainable2050 I’ve told many, many people over many years that I’m not on LinkedIn specifically because it’s a scam site that no self-respecting security aware person would ever use or encourage anyone else to use.Perhaps now they’ll understand what I was talking about.
(DIR) Post #B58eCwXSjjw5rjUkqm by AnachronistJohn@zia.io
0 likes, 0 repeats
@thephd It could be worse.https://zia.io/notice/ApcPW2g4YQq9OuRtTs
(DIR) Post #B5L674W7I1YJUBNCvA by AnachronistJohn@zia.io
0 likes, 0 repeats
@dalias Ages ago, I twisted my brain enough to learn Sendmail rules and came up with two HELO / EHLO checks: one which requires that the HELO / EHLO name resolves to the connecting IP(v6), and that the PTR for that address also resolves to the same address, and one that’s not as aggressive and just makes sure that the HELO / EHLO name resolves in DNS.Checking that the PTR name resolves to the same address as the PTR is beyond Microsoft. I think they’re not allowed to have O’Reilly animal books. They really take “not invented here” seriously, and considering they haven’t invented shit, nothing of theirs works properly.LOCAL_RULESETSScheck_mailKcheckdns dns -R AKcheckv6 dns -R AAAAKcheckptr dns -R PTRFH /etc/mail/access# require_dns.m4, 9-November-2003, John Klos (jklos@netbsd.org)# Updated 6-January-2007# Checks that HELO IP literal matches connecting machine, and# checks that HELO domain name resolves (but not necessarily back# to the connecting server), and that it isn't our name.# This HELO checking is what should be done, anyway; syntactically# invalid HELOs are allowed to be rejected. Checking whether a # HELO hostname resolves is my lazy way of checking the syntax.# localhost (real address, not HELO localhost) is always Ok.R$* $: $&{client_addr}R127.0.0.1 $@RIPv6:::1 $@RIPv6:0:0:0:0:0:0:0:1 $@# Skip checking if connection is authenticatedR$* $: <$&{auth_type}>R<PLAIN> $@# Reject addresses with no / broken reverse DNSR$* $: < $&{client_resolve} >R<TEMP> $#TEMP $@ 4.4.0 $: "450 Relaying temporarily denied. Cannot resolve PTR record for " $&{client_addr}R<FORGED> $#error $@ 5.7.1 $: "550 Relaying denied. PTR likely forged " $&{client_name}R<FAIL> $#error $@ 5.7.1 $: "550 Relaying denied. PTR lookup failed " $&{client_name}# Reject our own names. Anything that's in /etc/mail/access or # /etc/mail/local-host-names should not match any HELO name.R$* $: $&sRlocalhost $#error $@ 5.1.8 $: "550 Access denied. You are not obviously not localhost."R$=w $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."R$=H $#error $@ 5.1.8 $: "550 Access denied (access file). You are not "$&s"."# Reject common domain names which all use proper HELO strings.Ryahoo.com $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rjuno.com $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rgoogle.com $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Routlook.com $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rhotmail.com $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rmsn.com $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."# This test checks if the HELO string either matches or is the last part of # the PTR record for services such as Hotmail and Gmail.R$* $: <$&{client_name}> <$&{client_resolve}>R<$*$&s> <OK> $@# Skip checking if connection is authenticatedR$* $: <$&{auth_type}>R<PLAIN> $@# These rules assume that all will be OK if:# HELO [IP address] matches [{client_addr}] or# HELO [IPv6:IPv6 address] matches [{client_addr}]# Or, if neither of the above, that the HELO string must be a FQDN (primary# host name) as per the RFCs and therefore should resolve. Non-matching# [IP address] or [IPv6:IPv6 address] do not resolve as FQDN and fail below.R$* $: $&sR [$&{client_addr}] $@# Stick the connecting IP address into the workspace; if it's an IPv6 address,# replace it with the IPv6 address of the AAAA HELO lookup. If it matches# the connecting IP, it's Ok.R$* $: $&{client_addr}RIPv6:$+ $: <$( checkv6 $&s $: FAIL $)>V6R<$&{client_addr}>V6 $@# Stick the IP address of the A HELO lookup into the workspace. Fail# if the lookup fails.R$* $: <$( checkdns $&s $: FAIL $)>V4R<FAIL>V4 $#error $@ 4.1.8 $: "550 Access denied. HELO does not resolve. (HELO " $&s ")"R<$&{client_addr}>V4 $@
(DIR) Post #B5TEg08BwSKYut1pYG by AnachronistJohn@zia.io
0 likes, 1 repeats
@bitinn I wonder how this differs between people on Mastodon versus people on the Fediverse.
(DIR) Post #B5jdYqOZLbmk4rjQye by AnachronistJohn@zia.io
0 likes, 1 repeats
Microsoft deserves credit for being the dumbest company out there that's financially successful.Other companies like Google, Oracle, Cloudflare, Adobe, et merda, do dumb shit all the time, but they do those things because they're evil and intentionally want to cause problems. Microsoft is just plain dumb.A good example is that the Outlook (the email service) has existed since 2012, yet it's never not broken. Since some time around March 18th of this year, they decided to say fuck it to the idea of having server names match the connecting IPs.For example, BL0PR03CU003.outbound.protection.outlook.com resolves to 2a01:111:f403:c101::7, but the server that claims to be "BL0PR03CU003" (HELO / EHLO name) connects using 2a01:111:f403:c101::1.Those aren't the same, Microsoft!How TF does someone get this in front of someone at Microsoft / Outlook without going nuts?
(DIR) Post #B5pNWOFyYvxPuTHPu4 by AnachronistJohn@zia.io
0 likes, 0 repeats
@ska @navi Having a backup MX or a backup DNS server would give options. While mail often can’t be run on residential lines, DNS usually can.A backup MX will receive and store email to be forwarded, and you can just look directly in the mail queue to get the auth code, for instance.I completely agree that companies’ ideas about two factor are broken, are often added without asking and without configuration, and can be highly problematic during emergencies. At least you’re here, sharing with others, so others can consider whether they might be in the same scenario should a problem occur.
(DIR) Post #B5pat0149XYwnHPvA8 by AnachronistJohn@zia.io
1 likes, 0 repeats
I’d rather have S100 than $100.
(DIR) Post #B6ONSIwPBUQAnWm7Sy by AnachronistJohn@zia.io
0 likes, 1 repeats
@cwebber And datacenters are overbuilt. If we didn’t literally cripple our residential Internet, we could run datacenters from home.I had a colo go out of business while in possession of my servers, so I ran a full time email server for a few hundred users out of a house. Between the UPS and the auto-start generator, power’s about as good as a datacenter’s. The weak point was that I had to route public, static IPs through a tunnel to another colocated machine. If residential and non-residential Internet didn’t have a literal order of magnitude or more price difference, I wouldn’t even need the other colocated machine.The point is that some of us are using the leftover crumbs of what datacenters are for because we have few other practical options. It sucks, and it’s sad. Now it seems likely that even those crumbs will be harder to find. It’s not a good direction.
(DIR) Post #B6OSl7YYEhwGlHPRD6 by AnachronistJohn@zia.io
0 likes, 0 repeats
@cwebber Indeed! I have several issues with datacenters.First, using large amounts of water for cooling is NOT required. Evaporative cooling is NOT required. The fact that every so-called journalist writes about datacenter projects without calling out the megacorps who simply don’t want to pay for non-evaporative cooling just makes things worse.I have servers colocated in three different datacenters in three different US states. None use evaporative cooling. For years I had a quarter rack in a datacenter in Phoenix, Arizona, also without evaporative cooling. In Phoenix!Sure, people who like to make excuses for megacorps will say that high density compute like what AI companies want to build can’t be cooled without evaporation, but that’s simply not true. It can be done, but it costs much more, and AI companies don’t care about 10+ year ROI.The articles that don’t point out that all of these projects are bribing - er, negotiating cheaper power and water from municipal sources that are driving residential prices higher are doing everyone a disservice.All of this is one of many failings of capitalism. When a single corporate entity can demand so much of a service’s output that it can adversely shape the costs of basic, required services, there’s something wrong. The fact that there’s no governmental protections from this kind of abuse is highly problematic.It sure would be nice if journalists pointed out that the results of megadatacenters aren’t inevitable, but chosen based on how much hurt can be pushed on to everyone else.
(DIR) Post #B6Qk44jv1HUL45GoZk by AnachronistJohn@zia.io
0 likes, 0 repeats
@linear Luna has also turned off most of her non-essential services.
(DIR) Post #B6TGxtiYltipwmDThA by AnachronistJohn@zia.io
0 likes, 0 repeats
@rl_dane My top recommendation: self host.If you can’t self host, then my second recommendation is to find a friend you trust who’ll host your email.I’m happy to offer email hosting, but I haven’t done web-based access for ages (used to use Squirrelmail).
(DIR) Post #B6UVZUYQN0VTQNFvm4 by AnachronistJohn@zia.io
0 likes, 0 repeats
@linear @mjdxp I haven’t made the transition from vi to vim yet, so I’m interested to learn more from suggestions here, like this one. Thanks!
(DIR) Post #B7htMpWKrIgiUNZAPo by AnachronistJohn@zia.io
0 likes, 1 repeats
#NetBSD #pkgsrc SuperH binaries are in progress!My Plextor PX-EH25L is incredibly reliable. Even with only 64 megs of memory and living in swap for months, it just compiles and runs without issues... That is, until the IDE disk dies.It now has a new (to it - it's still IDE) 250 gig disk, it's been updated to NetBSD 11.0_RC5, and it's compiling #pkgsrc-2026Q2 packages already :)
(DIR) Post #B7htQu0s66qda3n6zw by AnachronistJohn@zia.io
0 likes, 1 repeats
#NetBSD #pkgsrc sparc64 binaries are in progress!I've updated my Sun Fire V100 to NetBSD 11.0_RC5 and started compiling packages, using distcc with a fast Ryzen system.I wish I could find a place to colocate or otherwise run my Sun Fire V245... It's much faster to have two 1.5 GHz UltraSPARC CPUs with 16 gigs of memory than one 550 MHz CPU with 2 gigs.