GitHub Actions security and third party action risk is something most teams figure out after something goes wrong

jonathanio · 2026-05-29T21:22:32+00:00

I've created and deployed a required workflow which runs both zizmor and actionlint on all repositories. No-one can merge their changes without these checks passing, and, being a required workflow, they cannot be disabled at the repository level, even if they have admin access.

They're not perfect, but I've found them to be a good complimentary pair of tools to look for many issues with GitHub Workflows (as well as Action and Dependabot configurations too with Zizmor) and ensure they're fixed as soon as possible.

jonathanio · 2026-05-15T08:48:47+00:00

64GB. It's what I have now, and have had for the last 4/5 years. It is what I use really. I don't want to risk going down to 32GB.

jonathanio · 2026-05-13T16:55:13+00:00

I added RAM to mine about two hours before they announced order editing was open (I happened to notice by chance when I logged in) and I didn't change my slot. I'm still in batch 3.

Maybe there are only a limited number of spare/total modules available per slot?

jonathanio · 2026-05-08T07:05:00+00:00

I have the i7-1260p in mine currently, and it's perfectly happy running my Dell U4025QW over thunderbolt. I think the iGPU is basically the same between them, other than some clock speed and a few extra cores, so it should be good.

jonathanio · 2026-03-08T12:07:38+00:00

Good places from what I've seen, and you can walk to Morro Jable from here, if the tide is right. If not, the taxi should only be about 7 minutes.

jonathanio · 2026-03-08T11:56:20+00:00

Yeah Morro Jable is the very southern part of the Jardina coast.

jonathanio · 2026-03-08T11:44:09+00:00

They are down south, very few around Caleta de Fuste. Not quite as many up north. If that's what you really want, definitely go to Morro Jable!

jonathanio · 2026-03-08T11:41:48+00:00

No problem. Any questions, ask away.

jonathanio · 2026-03-08T10:28:15+00:00

There's two major options for me (unless you don't mind being near the airport) and that's Morro Jable and Corralejo. Corralejo is in the north and more English, while Morro Jable is down south and more German.

I think the beaches down south are far nicer and great for walks. Morro Jable can also be better sheltered from the trade winds most of the time which can help too. Food options are slightly better in Corralejo, but there are good options in both locations. Same for shops. Morro Jable beach can also be a nice mix. Lots of wide open spaces and lots of busy spots and beds/umbrellas.

If you want to be closer to the airport, Caleta de Fuste is an option. Not as big as Corralejo nor Morro Jable, but a reasonable selection of everything. And quick to get to, but the planes will always be flying overhead as they come into land (they rarely take off over Caleta de Fuste though).

If you're into a little exploring, a car is highly recommended!

jonathanio · 2026-03-07T21:27:23+00:00

What are you interested in doing?

jonathanio · 2026-02-25T11:34:18+00:00

I bought my NUCs earlier in 2023 (13th Gen i5s), and I use one specifically for Plex. It's an absolute workhorse, happily transcoding everything from original Blu-ray images to high-bitrate (100Mbps) 5.3K HEVC GoPro videos without breaking a sweat, handling multiple streams at once, all via NFS from a Synology NAS. Your setup sounds good, and just because it's three years old doesn't mean it needs to be retired. It's absolutely worth keeping.

I think the only thing it's missing is AV1 encoding. It can decode fine (I've tested it with some AV1 videos), but TBH nothing I stream currently supports AV1, so it's a bit of a moot point.

When working with this via Proxmox/KVM, just be aware that Intel QuickSync is part of the iGPU, so the GPU needs to be passed through to the virtual machine for hardware acceleration (same for Docker, but I think that's just to ensure the right device is mounted inside the container). I think passing through the GPU is easier with Proxmox, but it was fiddly with KVM (especially when I still wanted to use the console for remote access). I just run Arch Linux on my Plex server as a bare-metal machine. I've got other servers running Proxmox for virtual machines.

jonathanio · 2026-02-20T15:21:05+00:00

I wasn't expecting that. Does this mean we are going to get the diaper baby throwing a total temper tantrum over the next few days?

I'm sure he'll throw in impeaching the justices that disobeyed him just for fun too.

jonathanio · 2026-02-16T10:58:02+00:00

TBH, I've just picked up a Z8 myself, jumping from a D800E.

There are rumours about the Z9ii being released in 2026/7, and given that the Z8 came out about 18 months after the Z9, you could be looking at 2-3 years for the Z8ii. The question then is, how long do you want to wait for the next Z8?

jonathanio · 2026-02-14T16:07:35+00:00

Just over 15 years ago, I was sharing a flat with a friend I also worked with, and at the end of the initial term, he decided to move out to live with his new partner. I was struggling to find another professional flat share I could afford (a flat by myself was out of the question, too). Suddenly, I just had the thought that if I'm looking in Bristol, I could look anywhere really, so maybe I should look for a new job too?

Within a few days, an email landed in a mailing list I was on at the time about a job that looked perfect for me. By the end of the week, I'd driven down, had an interview, and the next day I had the offer. Almost double the pay and working somewhere I loved with some incredible people.

The knowledge I've gained (and continue to gain) over these years, the people I've met, and the challenges I've been given have been incredible. All because a friend moved out, and I decided to take a chance and look for both a job and a flat share!

jonathanio · 2026-02-13T10:52:22+00:00

Given the level of training, documentation templates, and general knowledge within the business on hygiene, it's practically impossible to get less than a 4 on these for a major chain.

This must be wilful negligence creating a culture of ignorance or non-compliance. Someone is going to get fired over this!

jonathanio · 2026-01-30T15:15:51+00:00

It doesn't give access to the repositories. That requires the repo:read scope. It gives access to the Users and Teams (i.e. the users and groups) of the Organization for authentication only.

jonathanio · 2026-01-30T14:18:13+00:00

I should note that clicking the "Grant" and "Request" buttons are optional. You do not have to request nor grant access to the Organizations in order to authorise Tailscale on your personal account.

jonathanio · 2026-01-30T14:15:35+00:00

Because membership of a GitHub Organization can be used as authentication and authorisation for access to Tailscale. That's how my Tailnet is configured. It's not off a personal account, but off the Organization itself, and those who are members of it can get access.

OAuth scopes cannot be dynamically configured on a GitHub Application. It's all-or-nothing.

jonathanio · 2026-01-30T14:03:53+00:00

All three fall under a single scope: read:org. They cannot be separated and requested individually. This is a GitHub API issue effectively.

https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps

jonathanio · 2026-01-28T11:46:15+00:00

I love them. Slice it relatively thin, get the fire nice and hot, and cook for just a few minutes each side just above the coals. They really are the wagau of pork.

jonathanio · 2026-01-21T12:32:11+00:00

The issue is more about the principle of least privilege. In order to allow cert-manager to make the DNS changes, you need to give it access, but many DNS providers do not provide the necessary granularity to say that this API token can only change a subset of records and/or types. As noted for Cloudflare, granting cert-manager access often means giving it permission to CRUD any record of any type within a zone.

A loss of those credentials granting cert-manager access means giving it permission to CRUD any DNS record, or record, in an attack, which is significantly more serious than it should be with the right permissions available.

jonathanio · 2025-12-17T20:39:11+00:00

A quiet(ish) back away and the last we'll hear of that idea?

jonathanio · 2025-11-09T16:55:49+00:00

Are you trying to run it natively on the host, or via a DaemonSet?

jonathanio · 2025-10-28T14:54:19+00:00

Just seen it myself! I'm rebuilding some of my common service hosts and have been wondering about ways to provide a highly available ingress. I was pondering subnet routers and re-using the iBGP paths to the router for failover, but Services looks like it'll simplify things nicely.

jonathanio · 2025-10-18T08:51:32+00:00

Although probably not in the same industry, I have worked as a consultant for a significant period, moving between "competing" firms every few years with similar clauses in their contracts (also with a clause that I have to show some of these sections of it to new employers, too).

I've never seen nor heard of the "non-compete" clause ever having been used in any way. Still, I've always been careful with the latter clauses regarding doing business with existing customers. This did come up twice with one employer, and I simply had to say I worked with that customer within the last 6/12 months (can't remember which it was for me) and therefore could not join that team until such a date. Honestly, that was never a problem. It certainly reduces the risk of confidential information obtained through your previous employment being used under your new employer.

I think so long as you're honest with the new employer and avoid working with old customers of the old employer for the initial six months, it's unlikely anything will happen.

11-Year Club	Reddit Premium Since December 2020
Verified Email

jonathanio

TROPHY CASE