Sheogorath

https://microblog.shivering-isles.com/@sheogorath

Sometimes I post about #Kubernetes and #SelfHosting. Sometimes I don't.

Website: https://shivering-isles.com
Matrix Channels: https://shivering-isles.com/matrix
OpenPGP: https://shivering-isles.com/pgpme
K8s Repository: https://git.shivering-isles.com/shivering-isles/infrastructure-gitops

Public Key

npub1frkedgrjevuxctmsfkh2c8f2rmfq8mjk9rlufuvr9ujrwwdcd48sva5a27

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsy3mvk5pevkwrv9acymt4vr54pa5sraetz3l7y7xpj7fph8xux6ncprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyqq6gvzf0

Publishing to

relay.momostr.pink

Author Public Key

npub1frkedgrjevuxctmsfkh2c8f2rmfq8mjk9rlufuvr9ujrwwdcd48sva5a27

Show more details

Last Notes

2026-05-30 15:12:33 UTC

- reply

The 100 million number isn't completely dismissable, but also a bit of a wild, one, because from what I understand it counts accounts. Not monthly active users, not exclusively mail users, …
I would probably just cut the "obviously the biggest" an switch to "Proton is a very impactful user" or say "significant user" which expresses what you actually try to say.

2026-05-30 14:57:13 UTC

- reply

> Proton is obviously the biggest user of PGP at the moment
This statement is strange to me, because to me it's not obvious at all. Especially given that software based on GNUPG is used all around government work in Germany and potentially any NATO country.
Are there any statistics on that?

2026-05-06 06:45:40 UTC

- reply

It's good to wait for the post mortem. I'm sure there will be one. I hope it'll be public.

2026-03-17 11:11:57 UTC

- reply

Who can beat first hand experience?

2026-03-01 09:54:03 UTC

- reply

there is the basic problem that LLM are by definition a big tech technology. It's ludicrously expensive to train models from the ground up and requires incredible amounts of data that is hard to come by unless you disregard all copyright.
That's why the majority of "open weight" models are just modified versions of open weight models originating from big tech companies.

2025-12-30 11:15:30 UTC

- reply

less SD cards that might break at random points in time ^^

2025-12-14 19:45:45 UTC

I've been looking at people doing quote posts for quite a while now, and I conclude that quote posts were not a good addition to #Mastodon.
I would describe my observation like this: When I encounter quote posts, the conversation seems more disjoint. While it reduces the amount of screenshot posts, it seems to increases the amount of quote posts overall.
When people want to express their opinion about something someone posted, suddenly you need to follow 2 threads instead of one.
#fediverse

2025-12-14 17:52:01 UTC

- reply

but 30% are just 0.3 :D

2025-10-28 21:42:39 UTC

- reply

Are you taking bets?

2025-10-28 18:41:01 UTC

- reply

Not that I disagree with the argument that Signal could be run without hyperscalars, and especially when looking at the rising fascism in the US, it might be time to look for something that isn't solely relying on good will from people having dinner at the white house, BUT the mentioned toot and also comparisons to protocols like XMPP tend to fall short of understanding the complexity that the Signal infrastructure has to contain and the effort needed to fundamentally restructure these.

2025-09-10 19:07:29 UTC

- reply

Doesn't matter, the correct answer is: "Great!" :D

2025-07-18 14:08:30 UTC

- reply

leider kostet strom auch mal einen ähnlichen Faktor mehr.
Es bräuchte ggf. noch Heiztarife für Endverbraucher, die es attraktiver machen. Schafft man ja bei der Industrie auch irgendwie.
Oder mna muss halt dezentrale Energiegewinnung/Speicherung fördern.

2025-06-07 14:06:15 UTC

- reply

Is there a particular reason why some devices are offered with Ubuntu but not Fedora preinstalled? Is it just a "We haven't validated it with Fedora" issue or is that an indicator that the hardware support isn't fully there in Fedora (e.g. due to proprietary drivers or alike)?

2025-04-27 09:13:05 UTC

- reply

I heard some people have found joy in jj due to these topics: https://jj-vcs.github.io/jj/latest/
Which is basically built on top of git and other vcs tools. Maybe worth a look.

2025-04-26 21:29:32 UTC

- reply

I'm not sure how that is hostile. There is a workaround provided, and it looks like people have looked into the problem.
It mainly sounds like there was no real interactive communication happening, so it's all in the issue. It could probably be resolved by two people in a room or video conference where one can build fwupd versions and one can produce the issue and has an idea what is the ideal way of handling it.

2025-03-23 21:39:36 UTC

- reply

I guess you'll need privileged SCC or roll an own SELinux policy, since it'll finally be SELinux that stops you from accessing that device.
You can use the privileged SCC to run as SELinux contect SPC, and then drop all capabilities and change your UID using the security context. That's not amazing, but I'm reasonably sure it should work.

2025-03-10 18:24:55 UTC

- reply

If you pay by credit card, I recommend to go through the credit card provider. It usually helps a lot in getting your money back. You can certainly say that you only authorized the payment of the $44 subscription.

2025-01-27 22:13:39 UTC

- reply

be the change you want to see in the world ;)
Do you feel like we need another take on it?

2025-01-27 15:40:18 UTC

- reply

The risks F-Droid excels in managing by being a curated app store is protection from scam and phishing apps.
I know of not a single case where a fake or scam app has been part of F-Droid, which makes it a lot easier to recommend.
Do you have any good alternative curated app store?

2025-01-13 23:03:53 UTC

- reply

rpm-ostree search was added recently:
https://fedoramagazine.org/searching-for-packages-with-rpm-ostree-search/

2024-12-17 17:14:08 UTC

- reply

wasn't this a try to do that? https://github.com/zidansec/CloudPeler

2024-10-29 08:33:06 UTC

- reply

Google built this to scan documents from Google Drive with the right scanner.
So what is a safe default for "unknown" types? Which according to their benchmark are about 7%.
Do you scan them with all scanners? With none? How to avoid serving malware?
According to their announcement they managed to scan 3% more files with the correct scanner, at google's scale this easily outperforms the cost of training and using an minimal AI model to identify the filetype.
https://opensource.googleblog.com/2024/02/magika-ai-powered-fast-and-efficient-file-type-identification.html

2024-10-28 19:10:44 UTC

- reply

How does your SELinux do? ;)

2024-10-28 12:28:41 UTC

- reply

I recommend a look at this project:
https://rickvalentin.com/top-two-news-words-by-hour/
It's really puts it into perspective what has been going on in the past few years.

2024-10-27 11:34:47 UTC

People changing names really doesn't make it easier when you struggle with remembering names :D

2024-10-27 02:06:18 UTC

- reply

Me thinking you were talking about your vacuum robot and a potential miscalculation/mismeassurement in home assistant. But no, it's just factorio :D

2024-10-25 15:41:43 UTC

- reply

Wait, isn't that a US form?

2024-10-25 15:39:04 UTC

- reply

I really wonder if someone showed up at border control some day with a loaded crossbow and someone went: "Well it's not on the form, so it's probably fine."

2024-10-25 13:17:39 UTC

- reply

Classic "Why didn't you deliver the TV I paid for?!" "Oh, I think we forgot to order it…"

2024-10-25 09:08:10 UTC

- reply

Ja, "es müssen einfach nur alle…" ist ein sicherer Weg zur Enttäuschung.
Wir haben Schulpflicht und es kommen sogar Beamte bei der Zuhause vorbei, wenn da was nicht passt. Trotzdem gibt es Leute die es schaffen das nicht mit zu machen.
Natürlich ist der Prozentuale Anteil der Partizipation bei "Es kommen Leute vorbei und nehmen dich und/oder dein Kind mit" schon deutlich besser, aber es ist halt auch deutlich schärfer als ein paar Briefe und E-Mails.

2024-10-25 02:09:07 UTC

Philosophical, joking question: Is a monolith, really a monolith if the database is a separate service?

2024-10-24 19:38:17 UTC

- reply

Obviously depends a bit on your audience. If you want to contract any major organisation you'll probably face the question of SSO, there is a reason why every enterprise plan of SaaS companies contains it.
And given how effortless you can get an IdP these days, even for smaller orgs it makes sense to use SSO. Most companies will have at least one IdP in their company.

2024-10-24 19:26:39 UTC

- reply

You might even get Keberos Authentication without needing to deal with it, which can be quite amazing.

2024-10-24 19:25:39 UTC

- reply

Well, you get:
- Working account recovery flows
- Policy frameworks for users
- MFA
- passwordless authentication
- Account federation
- SIEM integration
- Better UX thanks to less password prompts
- …
So it's a bit more than a table in your app…

2024-10-24 19:22:25 UTC

- reply

But you can delegate the multi-org login thing to your IdP. keycloak can easily do this for you. That's the whole point, with OIDC you get an authenticated session with a user ID and claims of your choosing.

2024-10-24 19:12:56 UTC

- reply

But you end up doing at least the last part anyway. The majority of apps either start to integrate with an IdP at some point or become one themselves.
Mastodon, GitLab, GitHub, … all became IdPs some just with oauth others with OIDC. And the clients for these have to handle OIDC anyway. And the platform themselves also start to handle OIDC, because organisations need that for SSO.
But now they need to map OIDC onto their own account system, which usually ends up half-baked. :/

2024-10-24 18:26:49 UTC

- reply

But is it really harder than building a proper account system yourself? I think it looks harder because it might be a foreign domain to people.

2024-10-24 18:02:20 UTC

.__. My energy provider wants to change my electricity meter and hired a third-party company to do this, to confirm the appointment they have a webapp. With predefined username + passwort… that you can't change…
Despite the energy provider running a keycloak instance which they could just use to do SSO with OIDC :/
Why is it so hard for developers to not implement own account systems all the time?!!

2024-10-24 14:52:09 UTC

Somehow I often write AFAQ instead of FAQs.
It sounds a bit flawed because it shows that the document you write doesn't really answer the question.
AFAQ stands for "Anticipated Frequently Asked Questions" which is a preventive way of writing.
It's these questions were you feel like people will ask these no matter what I write, and they won't search for docs anyway but I can point them to the FAQ entry.
Mhm.

2024-10-23 10:47:17 UTC

- reply

als Ergänzung hierzu:
Wenn man es mal minimal durchrechnet:
Spiegel+ kostet 5€ pro Woche also 20-25€ pro Monat + ~50ct pro Woche für Werbefreiheit. Sprich 22-27,25€ für ein Vergleichbares Angebot der ÖRR.
Das ist nicht nur mehr als der Rundfunkbeitrag, sondern auch noch zusätzlich zum Rundfunkbeitrag. Effektiv eine Verdopplung der Kosten.
Außerdem gibt es für diese Abos keine Ausnahme für Bedürftige, wie es sie für die Rundfunkbeiträge gibt.

2024-10-23 10:42:13 UTC

What is going on with web components, I haven't heard about them in Ages and in the past two weeks I see the third blog post claim how awesome they are or aren't.
Are we on the next trend? Back to the DOM?

2024-10-22 21:44:17 UTC

- reply

I love that the short version of "Future of Financial Services" is "FFS". Hits the vibe.

2024-10-22 03:19:45 UTC

- reply

just don't get too comfortable they are about to switch from k3s to docker:
https://forums.truenas.com/t/the-future-of-electric-eel-and-apps/5409

2024-10-22 00:29:22 UTC

- reply

Simple Terramaster with TrueNAS.
Documented here: https://gitops-docs.s3.shivering-isles.com/hardware/nas.html

2024-10-21 16:14:41 UTC

- reply

Sind wir doch froh, dass die nicht alle bei gmail sind :)

2024-10-21 15:52:01 UTC

- reply

didn't they get "the biggest unix vulnerability of all time" announcement that turned out to be CUPS?

2024-10-21 11:36:08 UTC

- reply

but also a word of caution from experience with these attacks on my own infrastructure I can tell that these providers are also quick to shut your systems down and/blackhole the traffic if it starts to impact other customers, e.g. on the same VM host.
So it's more a best effort protection that will probably not work when you really need it.

2024-10-21 11:31:15 UTC

- reply

If you you only consider full layer 7 reverse proxying MITM, there are many ways to protect against up to L4 ddos attacks.
Look at Hetzner, Digital Ocean, AWS, … and alike for their managed loadblancer services and/or VMs which sometimes include "DDoS protection". They will try to filter out bad traffic on that level.
For basically all higher level protections without delegating them to a third-party, you'll end up needing to scale against the attacker which is just expensive for you.

2024-10-21 10:54:17 UTC

- reply

I really enjoyed using streetcomplete and just map the city.
https://streetcomplete.app/

2024-10-20 22:56:40 UTC

- reply

Besides the obligatory congratulations on this very special honour, I also want to congratulate you on the wonderful choice of shirt colour!
Looks good!

2024-10-20 14:41:53 UTC

- reply

Well, you can probably check the stats from existing registries (Here the Denic activity report):
https://www.denic.de/fileadmin/public/documents/activity_report/DENIC_Taetigkeitsbericht_2023_EN.pdf
And based on that calculate how many domains you would need to sell each year to sustain that model.
I'm reasonably sure that there are only small differences in operational costs in running a small TLD and a bit one.
And then you can also check how many domains they sold.

2024-10-20 13:52:31 UTC

- reply

You mean:
toot -v
*write write write*
:wq
2 minutes later
"Oh wait!"
toot --amend

2024-10-19 15:43:21 UTC

- reply

Isn't it beige clothing?

2024-10-18 14:41:00 UTC

- reply

nope, this is not a software update for Kubernetes.
Just Kubernetes adjacent software.

2024-10-18 14:38:22 UTC

- reply

Uhm, okay, I guess I should then 👀
https://artifacthub.io/packages/helm/si-gitops/mok
#kubernetes #email

2024-10-18 12:10:49 UTC

- reply

it's a bit more complicated, but 500 chars.
Long story short: Students are learning this, which makes them not the best ones to work on these systems. The systems habe blast radius that can affect a whole organisation and disrupt teaching for many.
So you require not only an expert in ops to recover potential unhealthy situations quickly, but also one that can teach what went wrong.
These are not cheap, and therefore it'll be certainly more expensive, not cheaper.

2024-10-17 17:05:53 UTC

- reply

looking at my keyboard, 30h would be closer 🤔

2024-10-17 15:01:56 UTC

- reply

PM=Prime Minister?

2024-10-16 17:27:45 UTC

- reply

They should sell nets!
I'll show myself out :D

2024-10-16 17:22:12 UTC

- reply

Well, if you look at how car insurances handle this, you won't be happy.
They just increase the price and provide a discount to those sharing the data .-.

2024-10-15 17:30:46 UTC

- reply

I have no direct experience with them, but given it's the UK, I guess reporting to the NCSC could stir up some movement: https://report.ncsc.gov.uk/

2024-10-15 17:12:43 UTC

So the other day, way too late, but somehow in the mood, I put together the 22 lines of JS it needed to bring this to life:
https://shivering-isles.com/energy-calculator
A small energy cost calculator intended for home infrastructure builder. If you run something 24/7 it can become quite quickly quite costly. So take the average power usage, and calculated for your estimated lifetime of the device. This way you know, when it's economical to buy newer hardware.

2024-10-15 14:32:02 UTC

- reply

that's why elasticsearch is optional. You don't need it to run Mastodon :)

2024-10-15 13:18:50 UTC

- reply

I guessed so, there were some subtile hints. ^^

2024-10-15 13:12:52 UTC

- reply

You have to start somewhere :)
Nothing wrong with cluster-admin if you are a compute-time donator :)

2024-10-15 13:11:16 UTC

- reply

Where you hungry while writing this? :D

2024-10-14 11:32:52 UTC

- reply

do you happen to have the source link handy? I think this is worth one of my TIL articles :D

2024-10-14 11:10:11 UTC

I feel like Teams is the Google Chrome of Microsoft.
Waiting for TeamsOS, which is a minimal OS that just runs Teams on top. Teams is the only frontend. Since all office products, communication and more are integrated anyway, it's only missing an edge integration to be feature complete.
👀 If anyone reads this and thinks: "That's a good idea!" Please be aware: 'NO, IT'S NOT AND YOU SHOULD NEVER BE INVOLVED IN PRODUCT DECISIONS EVER AGAIN!!!!'

2024-10-13 19:16:14 UTC

- reply

I really want to see that integrated into @npub1cdk…9f6t 👀 This would scale it dramatically.

2024-10-13 18:17:05 UTC

- reply

Uhm, what do you mean with "How do you use NFSv4"? You can either let your CSI-driver/provisioner (1/2) handle it, or create the nfs PVs yourself.
Just make sure your nodes have the needed packages installed.
To be fair, everything authentication related is a mess on NFS.
1: https://github.com/kubernetes-csi/csi-driver-nfs
2: https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner

2024-10-13 18:06:31 UTC

- reply

You'll certainly need to run restorecon on that FS.
Also you will probably run into conflicts with app versions and their configs, caches and stuff in your home directory. But overall, yes, that should work fine.

2024-10-12 23:50:15 UTC

- reply

Given that you were looking into VMs and containers:
cockpit-containers and cockpit-machines should be interesting to you. I'm not sure how exactly they are packed for Ubuntu, but I'm sure you'll find your way around.

2024-10-12 21:55:18 UTC

- reply

It's always a good time to learn something new. It doesn't have to be an either or decision.
You might want to look into cockpit which provides a nice management UI for containers and VMs on a single machine.
Or you go for proxmox which will run LXC containers and VMs.
If you want to go down the OCI container path, you might just use them inside your VMs, makes it easier to back things up and bring them back ;)

2024-10-12 15:57:34 UTC

- reply

I can save you the question to the BSI, I already got an official answer from them: https://social.bund.de/@bsi/113118953039516919

2024-10-12 14:45:16 UTC

- reply

Sadly it also shows how centralised the efforts of public-accessible internet archiving are.
We have various national libraries also archiving websites for their respective ccTLDs and government sites, but they are usually not web accessible, but on-site.

2024-10-12 10:02:36 UTC

- reply

it happens, I recently got a well made OVH phishing mail, that was good enough I almost clicked the link. (What threw me off was the fact it was in french and that it talked about domain renewals when none were due.
I was annoyed enough to look into the details on how to report this stuff and wrote a bit about it:
https://shivering-isles.com/2024/10/fighting-phishing

2024-10-11 18:49:51 UTC

- reply

Just for my understanding, how did the private browsing save you? Was it because the phishing campaign designed a "already logged in" page or was there something else going on?

2024-10-11 11:26:25 UTC

- reply

common issue with (traditional?) CR authentication is that both sides need the password in plaintext to validate.
Therefore password storage would become hazardous.

2024-10-11 09:13:29 UTC

- reply

hey, no sleeping on the job! ;)

2024-10-11 07:14:45 UTC

- reply

https://www.youtube.com/watch?v=lmbZXsyQKcM 🎵

2024-10-10 11:23:59 UTC

- reply

"but when i update my firefox they add new features i hate!"
If you don't some people who are not Mozilla might add new features to your system you certainly won't like. ^^

2024-10-10 11:05:00 UTC

- reply

maybe because they built it themselves? Just a thought why Google might use it :X

2024-10-10 10:58:07 UTC

- reply

for jekyll, here you go: https://github.com/jekyll/jekyll-admin

2024-10-09 17:23:56 UTC

- reply

ah, makes sense.
So if you are affiliated, you can't upgrade your themes or plugins? Still strange, but of course way less controversial.

2024-10-09 17:21:30 UTC

- reply

this innocent looking question packs quite the punch.
There are so many levels to unpack, from application boundaries, to licenses used at the top level, to origin of the software, …
But if we want a simple question with simple answers, it's quite simply no. One can not expect things to be open source just because they say it on the packaging.

2024-10-09 17:14:42 UTC

- reply

So if you don't, you can't access your blog, that you pay for? What?

2024-10-09 17:13:15 UTC

- reply

"soon" is a quite stretchy timeframe.

2024-10-09 11:02:35 UTC

👀

2024-10-08 18:49:13 UTC

- reply

They will of course use BGP on their home routers!
Wait, there are only 4294967295 ASNs… whoops!

2024-10-08 18:45:43 UTC

- reply

Well, it currently isn't because the chart isn't updated to mastodon 4.3.0. But it'll be at some point :)
This was probably put in there for experimentation and you can probably just update the versions and use it from there.

2024-10-08 17:41:39 UTC

- reply

There you go: https://github.com/mastodon/chart/blob/4f8599872242b01c6cbd90fc7522f09a99d6a64f/values.yaml#L277-L280

2024-10-08 15:48:24 UTC

- reply

It might sound strange, but the German Telekom with t-online has pretty much that setup. I think they use collabora office instead of only-office, but otherwise, yep, that's is.
Check for "MagentaCloud".

2024-10-08 15:39:47 UTC

- reply

Apparently, It's a Japanese lawyer with a Youtube channel and the link is to the unofficial wiki: https://historica.fandom.com/wiki/Takahiro_Karasawa
#10minutesOfOnlineSearch

2024-10-07 08:04:56 UTC

- reply

thanks, but part of reality is also that this wouldn't get big funding and wouldn't provide even remotely enough money in the first years to finance a company the size of Mozilla.
How big is the audience for a "Mozilla membership"? What price tiers does one offer and what do people get for that money?
In short despite sounding like good ideas, it doesn't seem very practical for the reality the organisation faces.

2024-10-06 18:26:03 UTC

- reply

I would probably start with build a managed browser CI service. Mozilla has the expertise of browser inside and can provide and build the APIs needed for ideal CI test. It can also utilise these tests to improve firefox itself. Selling that at a good price to companies might be a start.
Additionally one could start a yearly subscription service for a Mozilla membership. The goal there would be to partner with media companies for a global ad-free subscription.
500 chars…

2024-10-06 16:32:45 UTC

- reply

One could argue it's a form of regulatory capture.
https://en.wikipedia.org/wiki/Regulatory_capture
On the other hand, you have a significant amount of citizen using this service as their primary communication channel, so you might meet them where they are, in order to be useful.
We are in a bit of a pickle with the way the internet is currently shaped.

2024-10-06 13:01:01 UTC

- reply

This has been around since 2020: https://www.ghacks.net/2020/11/22/how-to-disable-sponsored-top-sites-in-the-firefox-web-browser/

2024-10-05 16:43:22 UTC

- reply

As Douglas Adams put it:
“Many were increasingly of the opinion that they’d all made a big mistake in coming down from the trees in the first place. And some said that even the trees had been a bad move, and that no one should ever have left the oceans.”

2024-10-05 15:24:35 UTC

- reply

well, if that isn't a huge impact then I don't know what is.
No one talked about it being a positive impact on actual value.

2024-10-05 10:10:36 UTC

- reply

fully evaluate them on the technical level is also not what they are aiming for in the study. But rather the question are general concepts known and are they evaluated by users.
For your password safe example it would be: why do you choose lastpass or apple's password safe over a spreadsheet?
In case of lastpass: Where you aware of the shortcomings that the "Note" field had (being unencrypted)?
Things like that. They have quite interesting interviews data in there