Hacker News: preisschild

New comment by preisschild in "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229"

preisschild — Fri, 30 Oct 2026 09:45:32 +0000

Tbf in the recent years Gitlab has become quite enshittified (most new work is focused around Duo) and the people working on more prominent public issues seem to have been laid off, so I dont have great confidence in its future.

Forgejo has fewer features, but those features work a lot better than the equivalent Gitlab features.

New comment by preisschild in "If IPv4 were land"

preisschild — Fri, 30 Oct 2026 08:48:52 +0000

Tbf there are always bad implementations. Good "smart" devices nowadays should be based on the Matter standard, which natively uses IPv6 addressing

https://en.wikipedia.org/wiki/Matter_(standard)

New comment by preisschild in "If IPv4 were land"

preisschild — Fri, 30 Oct 2026 08:45:28 +0000

much easier than `cafe.local` with mDNS :)

New comment by preisschild in "If IPv4 were land"

preisschild — Fri, 30 Oct 2026 08:40:11 +0000

i find NAT64 acceptable

New comment by preisschild in "If IPv4 were land"

preisschild — Fri, 30 Oct 2026 08:27:53 +0000

You can always just use IPv6 where there is plenty of address space available. You can even get a /44 as a hobbyist easily

New comment by preisschild in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

preisschild — Thu, 29 Oct 2026 08:22:35 +0000

I'm currently using the Radxa Q8B, which already includes EDK2 OOTB and provides the device tree to the linux kernel. But its still a new board and some things are not supported in mainline linux yet.

There are also less-powerful RK3588-based boards like the Radxa Rock5 series which are supported by this edk2 port: https://github.com/edk2-porting/edk2-rk3588#platinum. Thanks to collabora the mainline support is quite advanced: https://gitlab.collabora.com/hardware-enablement/rockchip-35...

If you are searching for more powerful enterprise hardware, AmpereOne SoCs have ARM SR certification. You can just use any modern linux distro uefi generic aarch64 iso and it will boot.

New comment by preisschild in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

preisschild — Wed, 28 Oct 2026 08:42:51 +0000

There is also HTTPS boot, which might be a lot more secure than PXE

https://tianocore-docs.github.io/EDKIIHttpsBootGettingStarte...

New comment by preisschild in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

preisschild — Wed, 28 Oct 2026 08:38:52 +0000

some arm64 sbcs support edk2/uefi btw. I make sure I just use those. Look for "Arm SystemReady" certification, which requires this

New comment by preisschild in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

preisschild — Wed, 28 Oct 2026 08:38:06 +0000

they also provide device trees to the kernel on modern arm uefi environments. And in servers they provide an interface for the baseboard management controller to interact with the firmware directly.

New comment by preisschild in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

preisschild — Wed, 28 Oct 2026 08:37:06 +0000

Before you manually configure a rule in your WAF you might as well just fix the vulnerability in the vulnerable component directly ^^

especially in free/open source software like edk2

New comment by preisschild in "Land Value Capture in Practice: Ethiopia's Urban Land Lease System"

preisschild — Wed, 28 Oct 2026 08:31:58 +0000

Its Georgism, after Henry George

New comment by preisschild in "Twelve years of distributed SQLite"

preisschild — Sat, 24 Oct 2026 16:10:03 +0000

I'd love to see a distributed sqlite solution using something like OmniPaxos[1] being used for consensus instead of raft

[1]: https://github.com/haraldng/omnipaxos

New comment by preisschild in "Around a dozen banking apps began specifically permitting GrapheneOS"

preisschild — Sat, 24 Oct 2026 11:13:09 +0000

Its not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.

New comment by preisschild in "GitLab critical patch release"

preisschild — Thu, 22 Oct 2026 04:26:16 +0000

I have renovate set to automerge gitlab patch releases

New comment by preisschild in "GitLab critical patch release"

preisschild — Thu, 22 Oct 2026 04:14:47 +0000

Dont even need "AI" for that. Just renovate.

New comment by preisschild in "France's supermarket fridges were vulnerable online for months"

preisschild — Tue, 20 Oct 2026 12:49:57 +0000

You are just exposing the application to the internet with extra steps in between

If the application is properly secured (strong encryption, strong authentication) there is no point for the VPN

and if the application isn't configured correctly, the vpn/internal network might not be configured correctly either.

New comment by preisschild in "France's supermarket fridges were vulnerable online for months"

preisschild — Tue, 20 Oct 2026 11:02:31 +0000

So you can control them over a network that you are almost always connected to, even if you are at home or mobile

New comment by preisschild in "France's supermarket fridges were vulnerable online for months"

preisschild — Tue, 20 Oct 2026 09:33:21 +0000

> at least IP whitelisting

home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?

And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.

New comment by preisschild in "France's supermarket fridges were vulnerable online for months"

preisschild — Tue, 20 Oct 2026 08:22:13 +0000

If you connect them to the internet you can control them remotely, there is nothing wrong with doing that.

New comment by preisschild in "France's supermarket fridges were vulnerable online for months"

preisschild — Tue, 20 Oct 2026 08:21:04 +0000

Internet-connected fridges are fine. Sometimes you want to control your fridges remotely and the internet is perfect for that.

But use strong cryptography (tls1.3) and authentication (oidc)