Hacker News: s_ting765

New comment by s_ting765 in "I close SSH port 22 (and what I use instead)"

s_ting765 — Sat, 15 Aug 2026 06:14:30 +0000

If one is so worried about zero days in openssh, the more practical solution would be centered around these 2 questions:

1. "would you know if you got breached?" 2. "would you have any reaction time?"

A simple solution that answers this: https://github.com/64mb/ssh-login-alert-telegram/blob/master...

New comment by s_ting765 in "I hate packaging my software for Linux"

s_ting765 — Wed, 12 Aug 2026 12:29:33 +0000

There is Open Build Service from openSUSE which allows you to create packages and repos for a handful of distros. https://build.opensuse.org/

New comment by s_ting765 in "Docker Sandboxes – Disposable, isolated sandboxes for AI agents"

s_ting765 — Mon, 10 Aug 2026 13:01:02 +0000

I use Flatpak/bubblewrap instead: https://news.ycombinator.com/item?id=48978112#48980221

New comment by s_ting765 in "Annoying and alarming things about OpenCode"

s_ting765 — Mon, 20 Jul 2026 15:27:10 +0000

The solution is not to use docker to sandbox Opencode. It is to use flatpak/bubblewrap/flatseal.

I have vscode running in flatpak with directory permissions handled by flatseal. Vscode only has access to my dev folders and nothing else. Even the git bundled by vscode cannot call git push because of this (vscode doesn't have permission to read ~/.ssh!).

It's an easy sandbox that's provided free of charge courtesy of bubblewrap/flatpak.

As someone who uses opencode regularly, the quip about it asking for permission to read logs in /tmp after already writing to the directory is pretty funny.

New comment by s_ting765 in "Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes"

s_ting765 — Thu, 16 Jul 2026 09:55:53 +0000

Kubernetes is good for two things. Zero downtime deployments and self-healing (where the looping state mechanism comes in). There are people who want k8s to handle every single operation that can run on a server, do not listen to those kinds of people they will lead you astray.

New comment by s_ting765 in "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"

s_ting765 — Wed, 15 Jul 2026 10:58:45 +0000

1.98.9 has already been tagged since bulletin was published (don't know why they chose on github to tag but not release).

1.98.9 version exists! That's not the question. It should already have been made available for Linux distros assuming this resource from Tailscale is accurate https://pkgs.tailscale.com/stable/?v=1.98.9

Edit: Their changelog also mentions the version: https://tailscale.com/changelog#all

New comment by s_ting765 in "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"

s_ting765 — Wed, 15 Jul 2026 07:33:24 +0000

I don't see the point of publishing a security bulletin if you are not going to timely push the fix to artifacts on all affected platforms. Tailscale needs to do better on their release process, docker hub shows last update was 8 days ago.

New comment by s_ting765 in "I Don't Maintain My Homelab"

s_ting765 — Wed, 01 Jul 2026 11:31:07 +0000

Same here. Even though my homelab runs on a VPS. https://github.com/rhee876527/expert-octo-robot

New comment by s_ting765 in "Replacing Systemd with OpenRC in Debian"

s_ting765 — Mon, 29 Jun 2026 10:46:21 +0000

Sure. After you have located root and the boot partition which is what this addresses.

New comment by s_ting765 in "Replacing Systemd with OpenRC in Debian"

s_ting765 — Mon, 29 Jun 2026 08:52:30 +0000

Partition autodiscovery is pretty neat. I did my archlinux install with it using this guide[0]. I have never touched /etc/fstab and I have had zero to worry about corrupting a boot with wrong fstab entries.

[0] https://walian.co.uk/arch-install-with-secure-boot-btrfs-tpm...

New comment by s_ting765 in "Minimus container images are now free"

s_ting765 — Wed, 24 Jun 2026 14:43:06 +0000

Pausing software updates by X days old is a hack at best for specific distribution platforms (npm), not a general security recommendation.

New comment by s_ting765 in "Frood, an Alpine Initramfs NAS (2024)"

s_ting765 — Wed, 17 Jun 2026 07:57:05 +0000

You can do the same from an USI made from mkosi (mainstream distros support) with kernel boot parameter systemd.volatile=overlay. https://github.com/rhee876527/UKIfy-Xubuntu

New comment by s_ting765 in "Open source AI must win"

s_ting765 — Sat, 13 Jun 2026 11:08:47 +0000

Well, open source AI is mostly coming from China. Title should have been China must win.

New comment by s_ting765 in "SQLite is all you need for durable workflows"

s_ting765 — Fri, 29 May 2026 20:43:13 +0000

This decision tree doesn't make much sense to me. Why you someone forego performance today in favor of adding a completely unnecessary network layer to every DB query in order to "satisfy" future imaginary "scaling concerns"?

New comment by s_ting765 in "An update on GitHub availability"

s_ting765 — Tue, 28 Apr 2026 11:17:25 +0000

> Vladimir Fedorov is GitHub's Chief Technology Officer .... He currently serves on the board of Codepath.org, an organization dedicated to reprogramming higher education to create the first AI-native generation of engineers, CTOs, and founders.

I think I found the issue.

New comment by s_ting765 in "State of Homelab 2026"

s_ting765 — Mon, 13 Apr 2026 08:05:24 +0000

What makes you think simply throwing random crap on a home VPN network is secure?

Tailscale/Wireguard is overkill because it is not needed where access controls work fine which is true for the majority of the popular self-hosted apps. And you now have to install a VPN client/cert on every device you want to access your services from. That's a major oof.

New comment by s_ting765 in "State of Homelab 2026"

s_ting765 — Mon, 13 Apr 2026 06:49:15 +0000

Tailscale is an overkill solution. Opening ports 80 and 443 for a reverse proxy is enough security provided your apps don't have broken authentication. I've been doing this for years now.

New comment by s_ting765 in "Open Source Security at Astral"

s_ting765 — Thu, 09 Apr 2026 12:03:35 +0000

Double checking Github actions does not mitigate threats from supply chain vulnerabilities. Forking an action moves the trust from a random developer to yourself. You still have to make sure the action is pulling in dependencies from trusted sources which can also be yourself depending on how far you want to go.

New comment by s_ting765 in "Open source security at Astral"

s_ting765 — Thu, 09 Apr 2026 11:05:12 +0000

Pinning github actions by commit SHA does not solve the supply chain problem if the pinned action itself is pulling in other dependencies which themselves could be compromised. An action can pull in a docker image as a dependency for example. It is effectively security theatre. The real fix is owning the code that runs in your CI pipelines. Or fork the action itself and maintain it as part of your infrastructure.

New comment by s_ting765 in "AI has suddenly become more useful to open-source developers"

s_ting765 — Wed, 01 Apr 2026 17:09:27 +0000

Coding agents are like asking a genie for code. They will give you the code you ask for alright but you never know what kind of curse has been crontabbed for you.