It could be relevant to those who want a bit more privacy in general or just want to reduce chance of receiving certain e-mails from your ISP. :)

Source and containers are available on Github but I don't have a public hosted service for now since I'm not yet sure where to put such a thing.

Let me know if you have any questions.

Comments URL: https://news.ycombinator.com/item?id=47595306

Points: 4

# Comments: 0

I made a custom Payload CMS block that allows to create and update excalidraw diagrams within the CMS. It supports dark and light mode switching and rendering inline or as external SVG.

And last weekend I added MCP server with Oauth so I could generate and update those diagrams and add them to post drafts from Claude. I think it is more convenient since I don't have to use API billing model and don't need to build a custom UI.

Here is an example post: https://www.janhouse.lv/blog/network/self-hosting-tailscale-...

Originally I wanted to sync posts from Obsidian but it doesn't have good enough image handling which I sometimes need and I needed extra metadata to unlist or password protect or noindex some posts.

And also I don't think their architecture is any good for such a product.

For me personally, it would be sufficient to avoid it based on the license alone. But altogether it just looks very unappealing.

Comments URL: https://news.ycombinator.com/item?id=47525061

Points: 4

# Comments: 0

But there is also Arch by the way :)

I use Claude Code a lot, I generate a ton of changes, and I have to review it all because it makes stupid mistakes. And during reviews it misses stupid things. This review part is now the biggest bottleneck that can't yet be skipped.

An in an open source project many people can generate a lot more code than a few people can review.

The better solution is to use tpm, unified kernel image and secure boot skipping the network unlock.

The whole process is like this -

1. enable secure boot;

2. generate and install your own secure boot keys (using sbctl);

3. use clevis to enable automatic unlocking of the root fs only when secure boot check passes;

4. generate the unified kernel image (in EFI partition) that is signed by your secure boot key;

4. use efibootmgr to enable booting of said kernel image.

(5.) If your CPU supports it, enable memory encryption in BIOS (to mitigate cold boot attacks).

The unified kernel image doesn't accept additional kernel parameters, so only parameters that are set during generation of the initram are used. The secure boot makes sure no one else has tampered with the boot chain. And TPM stores the disk key securely.

You can still add some additional network level check to make sure that your computer is in your expected location before unlocking.

And you can also include some recovery tools + dropbear in your initram (within the unified kernel image), if you expect that you will have to do some recovery from the other side of the world.

I think Linux has the best solution for this - good package managers for bases system and Flatpak with Flathub repo for other apps. So you never get stupid popups, and update managers use signed packages and check those signatures before installation.

I switched to arch 15 years ago to learn Linux. And it is by far the best way to understand it.

Having used Arch I can easily maintain almost any distro out there, but it doesn't work the other way around.

Depending on the language, scanning just the container is not enough, you for sure want to scan the lockfiles for full dependency list before it is compiled/packed/minified and becomes invisible to trivy/syft.