Remote

Nils Goroll 🕊️

@slink@fosstodon.org

mastodon 4.7.3

(he/him)
Does things #FOSS #HTTP and #VinylCache in particular.
Is one of the the last MSc in #AI graduates of the University of Edinburgh (1999) and watches what happens.
Linux user since 0.9.7 / sls 1.0

425 Followers

675 Following

50 Posts

Joined March 20, 2023

UPLEX:

https://uplex.de

:vinylcache: Vinyl Cache:

https://vinyl-cache.org/

gitlab:

https://gitlab.com/nigoroll

github:

https://github.com/nigoroll

Nils Goroll 🕊️

@slink@fosstodon.org

· 1mo ago

Replying to

@david_chisnall@infosec.exchange I would go so far as to say that being able to question yourself, actively and openly listen to feedback and accept valid criticism is more important than being smart. This is particularly hard because a lot of suggestions will be bad, and it is easy to take this as a sign for "everyone else being stupid". Catching the good ideas from the sea of bad ones is the challenge. The other part is to see and admit own mistakes.

3

0

1

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 2mo ago

I am looking for a #passkey implementation on #linux which ideally integrates with pass and stores its key material there.

I have found passless but I have doubts if the code is trustworthy.

Does anyone have a better recommendation?

passwordstore.org

Pass: The Standard Unix Password Manager

Pass is the standard unix password manager, a lightweight password manager that uses GPG and Git for Linux, BSD, and Mac OS X.

4

2

6

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 3mo ago

don't blame the bots - what can be exploited, will be exploited blame the platforms with their engagement metrics based visibility

5

1

1

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

i wish more people had the freedom to say these words:

"what you are saying is utterly stupid, your mental model is wrong and so are the conclusions you are drawing. good luck with your project, thank you and goodbye."

Fosstodon

19

1

12

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 4mo ago

RE: @rmondello@hachyderm.io

this statement is extremely helpful, because it explains the deep frustration i have with passkeys: for it professionals, they only make sense if used with multiple h/w tokens for resilience, but for the masses, they can only work if people shift their trust from self-managed security to vault providers. and that implies to once again give up freedom and independence: if the vault goes down or no longer likes you (if you're an icc judge), you lose ALL your access. if the vault leaks, popcorn!

Ricky Mondello: "When I use the word “passkey”, I am never refer…" - Hachyderm.io

8

0

7

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Does anyone have good input on how to do proper package signing with #gpg ?

Here's what I have so far:
https://code.vinyl-cache.org/vinyl-cache/pkg-vinyl-cache/issues/192#issuecomment-61151

code.vinyl-cache.org: Vinyl Cache open source code repositories

Signing Packages: how?

The Vinyl Cache Project has decided that we need to build packages on trusted infrastructure. At the moment, [UPLEX](https://uplex.de) is in the process of adding build infrastructure as forgejo runners. These are either LXC or KVM on a physical proxmox cluster which we own. Runners are using a p...

6

22

8

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 4mo ago

Replying to

@Gargron@mastodon.social learned:

videos without sound are treated like images
cw without cw text just blurs image/video

3

0

1

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

That's the deal. Take it or leave it. Final words We believe you should partner with us, a company that wants to be judged by their action and not in their words. We want to make a real difference. We see how utterly broken this whole industry is and we just decided to not play a sick game. But if this proposition does not appeal to you, fine. No bad feelings, do whatever you think is best for your company and move on. We're good.

6

0

2

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

Do not bullshit us with predatory legal text. Do not ask us to guarantee things which no company in the world can guarantee - if you want that, buy insurance instead (and even that won't solve the problem, but we can pretend for a moment that it would). Do not try to sneak into legal text transfer of copyright or ownership. You get the same license as anyone else, "despite" having paid us to do the work, but you also get all the good stuff that some other company paid for. No strings attached.

6

7

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@thomasfricke@23.social oh my. this is conway's law at it's best. I do not want to solve google's problem. I do not trust github. I want to allow our users to verify that we built a package. So this is not for me, at least not at this point. But thank you for the pointer anyways, I do appreciate your reply, this is no criticism of you.

4

8

1

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@bagder they are advanced in cyber cyber security: they have moved the "sudo" bit from the command line into the downloaded script 🤦🏻‍♂️

4

2

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

You want to fix interaction authorship with #forgejo for migrated repositories without enabling login via external providers?

Here's how to do this with plain PostgreSQL

https://code.vinyl-cache.org/vinyl-cache/code.vinyl-cache.org/src/branch/main/scripts/link_user

Enjoy the powers of #selfhosting

Fosstodon

3

1

5

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@jonashansen@troet.burg-halle.de die accounts nennen sich hashtags und heißen #dns und #denic

2

0

1

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

Our promise is an honest open source business model: You pay us, we publish all our work as open source and help you use it in a way which benefits your business the most.

3

9

1

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@leyrer@23.social @nicola@chaos.social right. ich möchte eine eu, in der ich mir das jeweils passende nationale recht aussuchen darf. it recht als alpen-exportschlager? ;)

2

1

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@Di4na@hachyderm.io @hipsterelectron@circumstances.run it imposes a massive burden on maintainers and does not have answers for fundamental problems. Like: Why the bias towards trusting github? How do they manage my keys? Why should I trust a millions-of-LOC node.js monster to build my code? I have really only just started and do not feel spending any more time with it was worth it. This looks very much like all the other plays the security theatre is staging. Again, at least for now.

2

2

2

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@Di4na@hachyderm.io just to clarify, it could have been a great concept even if coming from google. but coming from google explains a lot about why it is how it is.

2

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

Saving this for future self: This is basically entirely a google thing. https://github.com/slsa-framework/slsa/graphs/contributors MarkLodato google TomHennen google lehors IBM joshuagl verizon https://github.com/slsa-framework/slsa-github-generator/graphs/contributors ianlewis google laurentsimon works on gemini, so likely google asraa google

Contributors to slsa-framework/slsa

Supply-chain Levels for Software Artifacts. Contribute to slsa-framework/slsa development by creating an account on GitHub.

2

7

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

We believe that this value proposition is hard to find matched in the industry. There are many companies 'foss-washing' or 'open-washing' their products by talking an open source narrative, when in fact their entire business model is either upselling closed source components (open core etc), or capturing a market to then close down the license and escalate costs. Red flags for both are contributor license agreements and not accepting outside contributions with relevant value to enterprise users.

2

10

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

This means zero vendor lock in, no usage related cost, no hidden cost. The freedom to continue to work with our software even if you decide to work with other companies for support and development. The freedom to fork.

2

11

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

What we ask from you in return First and foremost, we charge for hours worked only. We can repackage hours worked if a project requires it, but ultimately, the deal is simple: We work for an hour, you pay us for an hour. We are a service company, even if we (also) write software. We do not sell a product. We do not sell licenses. Besides asking for your money in return for our work, we ask you to treat us like who we want to be: A partner who acts in your best interest.

2

8

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

What is our value proposition and how do we want to work? We, the team at UPLEX and our freelance partners, strive to provide for our customers and clients, who we regard as partners, excellent technical implementations of superior quality with no strings attached: We publish the most valuable and innovative results of our work under open source licenses, which give you, our customer and client, full power and control over software provided by us.

2

12

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@masek natürlich. und ich weiss auch, wer die arbeitsverhinderungscalls zum neuen heißen scheiß erklärt hat.

1

1

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@masek ach diese arbeitsverhinderungscalls…

1

3

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@isotopp https://fosstodon.org/@slink/116486258791687186

Nils Goroll 🕊️:vinylcache:: ""… between our controlled Rust environment and th…" - Fosstodon

1

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@groved@mastodon.social @meejah@mastodon.social @0xKaishakunin@mastodon.social thank you for your input. do you have any open documentation of your processes?

1

2

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@hzulla@infosec.exchange @mattze@mastodon.social @Fraengii@hessen.social @furocchi@hessen.social @BlumeEvolution@digitalcourage.social empfehlung: https://www.zusatzstoffmuseum.de/ mein highlight: kaltsterilisation - brrrr

zusatzstoffmuseum.de

Deutsches Zusatzstoffmuseum in Hamburg. Die Welt der Zusatzstoffe

Zusatzstoffe gehören ins Museum, nicht ins Essen! Erfahren Sie alles über die Funktion, Herstellung sowie Risiken und Nebenwirkungen von Zusatzstoffen.

1

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@leeloo@c.im very good point! I

1

1

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@fribbledom $ logout permission denied old joke became reality

1

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 7mo ago

Replying to

@bagder@mastodon.social on the low res preview, i read AI vulnerabilities. that's where the future growth is!

1

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@0xKaishakunin@mastodon.social interesting. Would you have links to the sources (tor/nix/deb)?

0

8

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 7mo ago

Replying to

@cliffle and this is authentic?

0

3

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@piko nicht witzig. gut.

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@hzulla@infosec.exchange @mattze@mastodon.social @Fraengii@hessen.social @furocchi@hessen.social @BlumeEvolution@digitalcourage.social ich spreche aus persönlicher erfahrung: ich habe eine unverträglichkeit gegen mono-natriumglutamat und scheine auch auf diverse zucker, zB dextrose zu reagieren. industriell verarbeitete lebensmittel kann ich nur in ausnahmefällen problemlos essen, weil sehr häufig ebendiese stoffe verwendet werden, um mit weniger aufwand ein "schmackhaftes" produkt zu erhalten.

0

2

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@leeloo@c.im Ah, btw, while I still do agree with your point, looking at it again I feel I really should point out that a "caching webserver" needs a _lot_ of customization to make best use of it, looking after which is most of our business these days. That might not be true for all caching webservers , but it certainly is for the one I recommend.

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@nik ich fand deinen hinweis hilfreich und bin dir dafür dankbar für den fall, dass es irgendwann nicht mehr anders geht. ansonsten werde ich jetzt nicht mehr antworten wie gewünscht.

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@hzulla@infosec.exchange @mattze@mastodon.social @Fraengii@hessen.social @furocchi@hessen.social @BlumeEvolution@digitalcourage.social meinem verständnis nach stehen viele in der lebensmittelindustrie verwendete zusatzstoffe, wie stabilisationssystene, emulgatoren, farb- und geschmacksstoffe im verdacht, die darmflora zu schädigen. für mich ist also "hochverarbeitete lebensmittel" keine schwurbelei, sondern ganz konkret etwas, was ich meiden muss, damit es mir gut geht.

0

1

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 6mo ago

Replying to

@Varpie @bagder yeah, i did not actually check, thx

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@nik @padeluun @e_es @digitalcourage wie schon geschrieben, bei bahnbonus ist es mW ein MUSS. wenn nicht, sage mit bitte jemand, wie ich ohne die app in die lounge komme.

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@nik ich möchte nicht erreichen, dass mensch sich via website einchecken muss. ich möchte erreichen, dass mensch weiterhin ohne tracking anonym mit einer fahrkarte reisen darf. die zeit im zug nutze ich gut.

0

2

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@nik eben gehört: "nutzen sie den komfort-checkin im db navigator, weitere infos finden sie auf bahn.de" also mE nicht gleichwertig

0

1

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

RE: @fluepke@chaos.social

bahncard 100 - der mythos der schwarzen mamba lebt fort

#DeutscheBahn #bc100

Flüpke: "Produktinformation DB Fernverkehr" - chaos.social

0

2

2

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 7mo ago

Replying to

@cliffle i am just curious if this is an actual blueprint, or whatever the proper technical term might be? it's beautiful!

0

2

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@nik und btw: wir müssen mE erreichen, dass da nicht noch mehr durchgestrichen wird. denn wenn die bahn wollte, könnten sie alles platt machen und nur noch ihre trackenden apps auf appstore-monopolen supporten

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@nicola@chaos.social ist der hackerparagraf verfassungswidrig? eu-rechtswidrig? menschenrechtswidrig?

0

5

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@trochee brilliant

0

0

0

0

Nils Goroll 🕊️

@slink@fosstodon.org

· 5mo ago

Replying to

@neil dog fur now highly sought after

0

0

0

0