Hacker News: Arrowmaster

New comment by Arrowmaster in "Bitwarden Dual License Model"

Arrowmaster — Sat, 10 Oct 2026 17:13:26 +0000

When I stopped using KeePassXC, there was no merging. You configured each client to save immediately and reload when detecting the file changed. If you used a tool like Syncthing then you had to monitor for conflicts (which stopped syncing) and manually fix them. If the major clients on Linux, Android, and browser extensions all supported proper syncing on their own, I might switch back.

New comment by Arrowmaster in "Bitwarden Dual License Model"

Arrowmaster — Sat, 10 Oct 2026 16:20:36 +0000

I specifically moved away from KeePassXC to Bitwarden with self hosted vaultwarden because the Linux desktop experience and mobile syncing was so terrible. While I love KeePassXC, using it on an immutable Linux distro where everything needs to be Flatpak means the browser extension doesn't work because it doesn't support Flatpak'd browsers back when I switched. Auto type is a security nightmare and is not an option. Syncing does not exist and with the constant death and forking of Syncthing on Android, it became unusable to randomly find out my db hasn't synced for a week and now I have to reset everything with a new fork yet again.

Bitwarden was the no nonsense choice because it just worked.

New comment by Arrowmaster in "Radicle: Disclosure of Vulnerability in the Network Protocol"

Arrowmaster — Wed, 23 Sep 2026 19:52:28 +0000

To be fair even the largest companies are still using curl piped to sh in their Linux install instructions. And they are all fucking imbeciles.

New comment by Arrowmaster in "Hackers Got Inside a Flock Camera"

Arrowmaster — Wed, 16 Sep 2026 15:54:45 +0000

It's almost as if they paid a contractor to design the hardware back in 2017 and put all the funding into marketing(bribes) since then. Shocker.

New comment by Arrowmaster in "Rune is now open source"

Arrowmaster — Sat, 12 Sep 2026 16:04:39 +0000

Flatpak is the best of all bad options for multi-distro Linux packaging. Adapting to the sandbox if you aren't already using portals will probably be a pita though.

New comment by Arrowmaster in "ESP32 Bit Pirate Hardware Hacking Kit with Web Tools That Speaks Every Protocol"

Arrowmaster — Thu, 10 Sep 2026 19:37:54 +0000

Is this a professional project you created on behalf of your employer or your own business for monetary gain?

Just because you are forced to use AI on the clock doesn't mean you have to for personal projects.

New comment by Arrowmaster in "deSEC – Free Secure DNS"

Arrowmaster — Sun, 06 Sep 2026 13:43:44 +0000

These are completely different types of services. One is a DoH recursive DNS resolver for use by clients. The other is a DNSSEC enabled DNS hosting provider for domain owners. The encryption in use is completely different with different goals.

New comment by Arrowmaster in "Show HN: Linux server management over SSH – written in Rust and Tauri"

Arrowmaster — Mon, 31 Aug 2026 20:29:12 +0000

The README for wry under Platform Considerations suggests its not actually implementing the webview but just a wrapper that uses the correct one for each platform. The usage of WebKitGTK IS the problem that makes it second class on linux. I talked about this more in https://news.ycombinator.com/item?id=49514323

New comment by Arrowmaster in "Show HN: Linux server management over SSH – written in Rust and Tauri"

Arrowmaster — Mon, 31 Aug 2026 20:11:14 +0000

Sure. Tauri tries to claim its lighter than Electron by not including a full web browser in its runtime and instead using the system renderer. But Linux doesn't have a universal system renderer like Windows and Mac does so it uses Webkit2Gtk on Linux. Libwebkit is an absolute mess of a library. It hardcodes the path to /usr which doesn't work in AppImages resulting in this[1] hack of a fix that replaces `/usr` with `././`. This problem isn't unique to Tauri as I have seen apps using Wails copy this same trick to package their AppImages.

Now the problem with libwebkit goes even deeper because Tauri uses libwebkit2gtk-4.1 after moving away from 4.0. When you build an AppImage you want to do it on the oldest possible distro you want to support because it will be built against GLIBC of that distro release. Due to how most devs release apps now, that means they compile against an Ubuntu LTS release because Ubuntu is the only option with Github Actions[2]. The first LTS version of Ubuntu with 4.1 is 22.04, so now by default you can expect every Tauri (and also probably Wails) AppImage to be built against GLIBC 2.36. But theres a bug in the interaction of older libwebkit2gtk and newer freetype that happens when you use an AppImage built on Ubuntu 22.04 on a newer distro. It crashes when displaying an emoji character. Freetype is one of the libraries you cannot include in an AppImage but you must include libwebkit2gtk, the solution is to use a newer libwebkit2gtk but thats only available in Ubuntu 24.04 and bumps the GLIBC to 2.39. Do you see how much of a mess this usage of libwebkit2gtk in an AppImage turns out to be.

And moving beyond that, the Tauri devs has an absolute disdain for the AppImage format and treat it as a 2nd class platform as you can see in this[3] PR where AppImage developers tell the Tauri devs to update to newer tools instead of mirroring the old obsolete broken tool that was taken down. This also meant that AppImages created by Tauri's build tools depended on libfuse2 being installed on the system while newer AppImages using the type2-runtime do not anymore. I believe Tauri has finally moved forward and stopped doing this recently. Electon is no better on this and electron-builder uses an outdated hardcoded tool that makes bad AppImages that depend on libfuse2 too.

I do like the AppImage format, but I do not believe anything that uses libwebkit2gtk-4.1 is fit to be distributed as an AppImage at this time. This means that Tauri (and by extension probably Wails, and some of these other NOT Electron frameworks) are not fit to be truly called cross platform. It does look like Tauri was making progress on Flatpak documentation so app developers could have a second cross distro packaging method. Ideally I think any framework that wants to label itself as cross platform should make it easy to package both AppImage and Flatpak and not run into the above libwebkit2gtk issues.

[1]<https://github.com/tauri-apps/tauri/blob/ad0b98a2329e369364e...>

[2]This is not entirely true, you can use a docker image inside the Github Actions Ubuntu VM or a sysroot but that is beyond even most expereinced app devs to setup.

[3]<https://github.com/tauri-apps/tauri/pull/13863>

New comment by Arrowmaster in "Show HN: Linux server management over SSH – written in Rust and Tauri"

Arrowmaster — Mon, 31 Aug 2026 17:00:56 +0000

Won't happen until Tauri can treat Linux as a first class platform. Which they cannot do because of architectural design and library choices.

New comment by Arrowmaster in "Show HN: Linux server management over SSH – written in Rust and Tauri"

Arrowmaster — Mon, 31 Aug 2026 16:56:40 +0000

Why not make this post the day after tomorrow then instead of today?

New comment by Arrowmaster in "Show HN: Linux server management over SSH – written in Rust and Tauri"

Arrowmaster — Mon, 31 Aug 2026 16:54:28 +0000

The choice of Tauri for a Linux app using AppImage is a dead giveaway they have no clue what they are doing.

New comment by Arrowmaster in "Omarchy: Any User Process Can Escalate to Root"

Arrowmaster — Mon, 31 Aug 2026 04:53:09 +0000

This is hilarious. He isn't American and isn't talking about American in his racist rants. The people calling out his racism aren't focused on America or a majority American. His main blog post that gets called out for the blatant racism is titled "As I Remember London".

New comment by Arrowmaster in "Omarchy: Any User Process Can Escalate to Root"

Arrowmaster — Sun, 30 Aug 2026 19:19:05 +0000

His own blog posts present him as what he is. Have you read them?

New comment by Arrowmaster in "Omarchy: Any User Process Can Escalate to Root"

Arrowmaster — Sun, 30 Aug 2026 18:28:21 +0000

I don't care what he's doing, I care about what he is.

New comment by Arrowmaster in "Omarchy: Any User Process Can Escalate to Root"

Arrowmaster — Sun, 30 Aug 2026 18:26:57 +0000

I don't think flatpak allows access to hidden files so even those with access $HOME cannot do this.

New comment by Arrowmaster in "German court rules: Emails must be end-to-end encrypted"

Arrowmaster — Thu, 20 Aug 2026 13:51:07 +0000

Maybe someday a real end-to-end encrypted email solution will finally exist.

Until then all we have are solutions that only work between a small handful of providers or "click this link to view your secure message" garage that could just as easily be replaced and faked.

New comment by Arrowmaster in "A joke domain purchase turned in geopolitical warfare"

Arrowmaster — Wed, 19 Aug 2026 15:28:13 +0000

It's because curl is often embedded as a library or standalone executable with other software. So when a malicious or compromised piece of software is found, a less experienced investigator might see curl with its author tags in the file metadata, and follow it back to upstream.

New comment by Arrowmaster in "Devices with GrapheneOS support should be available in 2027"

Arrowmaster — Wed, 19 Aug 2026 14:11:21 +0000

The 2026 Signature doesn't appear to be for sale in the US. Does this mean we have to wait for the lower end devices if we don't want a fold/flip?

New comment by Arrowmaster in "Ask HN: Alternatives to GitHub"

Arrowmaster — Mon, 17 Aug 2026 15:12:17 +0000

I don't have any specific recommendations other than do as little in your CI/CD as possible, instead do as much as possible in your build system or scripts that get called by CI/CD. This way you can migrate with less work or run locally when you want.