Another example of Rust is safer than C. The security issue with "" of ALpine linux and OpenSSH would not exist in Rust where the error is not a simple `` symbol. See https://next.ink/266066/une-faille-dans-alpine-linux-permet-de-se-connecter-avec-un-mot-de-passe-trop-long/

1. Audit, pin and fetch the dependencies
2. Disable install-time and build-time scripts
3. Secure-by-design architecture: design for evolution, principle of least privilege, data minimization
4. Runtime hardening: drop privileges with landlock: For that I use the landlock crate to allowlist the very few files and directories touched by my services.
5. Use KMS with envelope encryption instead of a secret manager
6. Minimal containers and virtual machines

The new owner is modernizing CSS Tricks. The Almanac Index of the CSS has improved navigation and there is a new index for the guides.

Il suffisait de rentrer un mot de passe de 256 caractères.

La vulnérabilité réside dans la rencontre entre deux conventions, qui n’ont rien d’anormal quand elles sont prises isolément. Ainsi, pour un compte sans mot de passe, Linux enregistre un unique astérisque à la place de l’empreinte. Mais Alpine utilise la bibliothèque musl, pour des besoins de légèreté. Celle-ci, quand elle doit calculer l’empreinte d’un mot de passe de plus de 256 caractères, refuse. Pour signaler l’erreur, elle renvoie… un simple astérisque. Le problème est alors évident : le serveur compare les deux, en déduit qu’il s’agit de la même empreinte et ouvre la session. Pour effectuer ce calcul, le serveur emprunte un paramètre depuis un compte possédant un vrai mot de passe, d’où la nécessité d’avoir au moins un tel compte configuré.

Systemd will support Rust. The leaf components (individual binaries) will be supported.

All funny ways to create strings

The lite version without AI exists for DuckDuckGo

For fluid typography, container-type: inline-size makes the wrapper a container query, so its children can use cqi: a unit based on the container rather than the viewport.

text-box-trim: trim-both removes the line-height, while text-box-edge: cap alphabetic measures from capital-letter caps to the alphabetic baseline.

hanging-punctuation lets specified punctuation sit fractionally outside the text block's edge.

font-variant-emoji makes the choice between full-colour and monochrome emoji explicit.

Much of this CSS removes work that used to leak into other parts of a build.

A list of links to find services providing images

Servo is progressing

Htmx with Hono and Astro are the cheapest.

Angular costs most.

List the dependencies of Linux binaries

The repository is available at https://github.com/stolk/sotrace

Why VPN and emails are hard to operate actually.

Both VPN and email are well understood services, there is no shortage of people with expertise, it is not a big technical challenge to set up and operate...

Each became impossible or unattractive after talking to people who have operated them at deep levels over time. Here is why:

A white label email service provider relates:

• 10 people are needed to respond to CSAM requests, not including lawyers and LE relationship people.
• 30 people deals with spammer. Managing their ASNs, netblocks that get lower reputation on blackhole lists, moving customers to "clean" netblocks when a shared block gets polluted by spammers, etc.

VPNs need to spin-up secure VPN gateways all over the world. Fast while having a pool of providers.
Discussing with a VPN dude: "I asked why keep all the separate brands and marketing if it’s all basically the same thing, and he explained the market is segmented. Some users believe a particular VPN is better for gaming, or business, or torrenting, or porn, or cheapest or whatever. It actually hurt them the couple times they tried to merge brands, so now they try to merge all they can behind the scenes technically but keep the brand identities separate."