I think some people may not be reading closely. On Unix, "/etc/services" is a file, not a directory:

  $ file /etc/services                                                                                                                         
  /etc/services: ASCII text

rsync -av -e ssh /etc/services example.com:/tmp/services

The above command creates a mirror of the local file /etc/services in a remote file called /tmp/services. The outcome is exactly the same as if I had run "scp /etc/services example.com:/tmp/services"

  client$ sha256 -q /etc/services                                                                                                                    
  469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a

  server$ sha256 -q /tmp/services                                                                                                          
  469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a

The above command creates a mirror of the local file /etc/services in a remote file called /tmp/services/services. The outcome is NOT the same as if I had run "scp /etc/services example.com:/tmp/services"

Please note that "/tmp/services" and "/tmp/services/services" are different.

  client$ sha256 -q /etc/services                                                                
  469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a

  server$ sha256 -q /tmp/services  
  sha256: /tmp/services: read error: Is a directory
  server$ sha256 -q /tmp/services/services                                                                                                 
  469d28e72ed0e0994d31b555cc1bed7bc95a23fd1beeb30062affb64db0dd44a

rsync -av -e ssh /etc/services example.com:/tmp/services

The above command creates a mirror of the local file /etc/services in a remote file called /tmp/services. The outcome is exactly the same as if I had run "scp /etc/services example.com:/tmp/services"

If you disagree, please state what operating systems you're using and copy/paste the output of the following commands on each side:

  uname -a
  rsync -V
  openrsync -V

  $ rsync -V
  rsync  version 3.4.3  protocol version 32
  (snipped)

  $ openrsync -V
  openrsync 0.1 (protocol version 27)

openrsync --rsync-path=openrsync -av -e ssh /etc/services example.com:/tmp/services

And then type "file /tmp/services" on the remote server.

No. And just to make sure, I ran a quick 'rm -rf /tmp/services' on the remote host, then re-ran openrsync on the client. Same result. This is OpenBSD 7.9 on both sides.

And I 100% agree about trailing slashes.

The one place in my usage where it doesn't match Samba rsync is with the following:

openrsync --rsync-path=openrsync -av -e ssh /etc/services example.com:/tmp/services

I would expect openrsync to create a remote file /tmp/services, but instead it creates /tmp/services/services.

Normal directory mirroring as in -av -e ssh /path/to/src/ example.com:/path/to/dst/ works as it does with Samba rsync.

Good writeup. I only used Gandi as a domain registrar so I was only familiar with the insane cost increases. What a terrible company:

> Gandi now informed them that their email would be suspended unless they paid extra, effectively retroactively changing the terms of a service already paid for.

They can't use age or any other "right answer" tools. I'm talking about people who don't know their own username, people who don't know that their Windows password is the one they use to log into Windows. "Is that for my email?" Just getting them to use a password manager is like arm wrestling an aligator. If VeraCrypt isn't the best option for them, then what is?

Does anyone use Thunderbird with Gmail and 2FA, and does it work correctly 100% of the time there?

Comments URL: https://news.ycombinator.com/item?id=46925631

Points: 1

# Comments: 0

https://en.wikipedia.org/wiki/Cost_of_electricity_by_source

I'm also interested in smartphone operating systems like Ubuntu Touch and postmarketOS etc.

Comments URL: https://news.ycombinator.com/item?id=46098007

Points: 1

# Comments: 0

This is not correct. There isn't a cdb subdomain because cdb.cr.yp.to doesn't have NS records, which is where DNSCurve fits in. If you have a DNSCurve resolver, then your queries for cdb.cr.yp.to will use DNSCurve and will be sent to the yp.to nameservers.

From there, if you have pqconnect, your http(s) connection to cdb.cr.yp.to will happen over pqconnect.

Maybe the confusion is because both DNSCurve and pqconnect encode pubkeys in DNS, but they do different things.

Here is DNSCurve:

  $ dig +short ns yp.to
  uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to.

  $ dig +short cdb.cr.yp.to
  pq1htvv9k4wkfcmpx6rufjlt1qrr4mnv0dzygx5mlrjdfsxczbnzun055g15fg1.yp.to.
  131.193.32.108

Low Tech Magazine wrote an article about this here:

https://solar.lowtechmagazine.com/2020/12/how-and-why-i-stop...

https://app.electricitymaps.com

I just installed Open Street Map (the iOS app is called OsmAnd) and it looks nice! Zoom in/out is much better than on Apple Maps. A quick check of a route I know produced a good map, so I'll start using OSM from now on.

Comments URL: https://news.ycombinator.com/item?id=43765281

Points: 1

# Comments: 0

The post had a number of grammatical errors too, so if "whilst" we're at it, should we criticize all of European education? Please don't post low-effort negative nationalism. It's cheap and the subject (the richest person alive is apparently a nazi) is a serious matter.

If you read Drawdown, you'll see that it doesn't cost money to stop climate change, it saves money.

https://drawdown.org/the-book

I assume but don't know for sure that this refers to Veriexec in NetBSD, and I'm not sure what in HardenedBSD. Anyone know?

https://man.netbsd.org/veriexec.8

My understanding is that Veriexec isn't enabled by default - the manpage says only that "[s]ome kernels already enable Veriexec by default." If you have this enabled, how do you upgrade binaries? The manpage says that in strict mode 1, write access to monitored binaries is allowed but then access is denied. So I assume that after file modification, root then runs veriexecgen and veriexecctl load as mentioned in the manual to update the signatures list. So it seems that strict level 1 isn't functionally different from a read-only /usr or even just root-owned binaries. In either case, you just need root to update targeted binaries. Surely I'm missing something and would appreciate some insight.

At a glance as an outsider, stricter modes appear somewhat functionally similar to "chflags schg" on BSD systems, where more work is needed to get around restrictions. In the case of schg, you have to reboot into single user mode, remove the schg flag, then modify the binary, and continue booting into multi-user mode. You could do this as a remote attacker (as in not having console access) depending on what boot files are or aren't protected with schg, but modifying all the necessary files can be a source of new problems.