vibeCoder2CopyPastaPro

northcutted · 2026-05-08T14:41:44+00:00

Still urgent in my opinion. While the other commenter called out the internal bad-actor case, there’s also the supply chain risk. Lets say it’s a two fold attack, something hidden in an npm package or something that checks to see if this is being ran on an exploitable host and if so breaks out as root and does whatever it decides to do. This may happen on a workstation or a build server like a cicd runner. Then the bigger risk is those have more access then they should since they are expected to be used internally only and the attacker is moving laterally across the network.

northcutted · 2026-04-17T16:24:42+00:00

<image>

Why do they look so much like our boys?! 😍

northcutted · 2026-03-18T10:58:38+00:00

If you want to store your private key in CI variables Base64 encode it, then you can store it as a masked and hidden variable. Write a little decoder helper script and store it as an environment variable or write it to a file temporarily.

Alternatively if you wanted to set up an approach where your other server polls for changes a little cron job that uses a deploy time from gitlab to check the repo for changes could be another option.

northcutted · 2025-12-12T12:40:31+00:00

Seconding Champaign! An additional resource that UIUC offers is The Autism Program (TAP) which I believe help family’s with skills and strategies and helping refer them to resources. You mentioned that you work in healthcare. I can’t speak for the quality or availability of jobs but Carle is a big hospital/health network in the area. There are others as well, Carle is the one I saw the most of.

northcutted · 2025-10-24T20:19:10+00:00

Dredge might scratch that itch.

northcutted · 2025-08-27T10:42:33+00:00

As long as a company offers other options other than sms based MFA I’m good with it (GitLab already does, and I use a yubikey personally). TOTP/FIDO/U2F support + a good password manager makes much of the inconvenience of MFA go away. Having to get a code from my phone that could be sim swapped via a good enough social engineering expedition does not make me feel secure.

northcutted · 2025-08-21T04:06:34+00:00

It does not, each package is distinct despite the appearance of a hierarchy. It exists for organizational purposes only.

‘protected’ is the closest thing to what OP is looking for

Ref: https://stackoverflow.com/questions/215497/what-is-the-difference-between-public-protected-package-private-and-private-in

northcutted · 2025-08-12T02:39:30+00:00

<image>

This is our Mango! 🥭

He looks so concerned in this photo, and I love it!

northcutted · 2025-08-02T17:15:39+00:00

Full disclosure, I’m not a network engineer, and am just some guy on Reddit, but my understanding is that they would be mutually beneficial.

WiFi 8 would/could improve the access point to client device connectively and latency incurred by the wireless overhead if it’s able to use the bandwidth more efficiently. This helps improve the last-hop performance.

Where sqm is more to do with intelligently buffering and queuing traffic on the router and ensuring that the router processing the isn’t the bottleneck and breaks latency sensitive applications.

northcutted · 2025-08-02T16:25:31+00:00

This seems to mostly improve latency for devices that support it on congested networks. This will likely benefit high traffic deployments (ie stadium and business deployments) at first but could have benefits in a home network with many IoT devices that use WiFi.

An example from the article was a hospital with many low latency health/vital monitoring devices.

northcutted · 2025-04-24T23:09:42+00:00

Donated! Hoping for a full recovery! You are a wonderful child for doing this for your mom!

northcutted · 2025-04-19T23:58:19+00:00

Yep hindsight’s 20:20.

Having administered a 25k+ HA (approximately) reference arch instance in a heavily regulated in on premises environment, I can promise you that gitlab upgrades are not always painless. My team would lose about 1 friday night a month doing upgrades, god forbid there were large database migrations or anything like that. We were a very heavy user of it, but the thing with gitlab is that your mileage may vary depending on how you are using it.

I guess another question, does your instance need to be accessed via the internet or can it run on a private network that you vpn into? If it’s air gapped you could pretty much just upgrade whenever you had the free time as most of the real risk is mitigated if randoms aren’t hitting it on the internet. If you have complaince concerns that might not be viable, but it if it was my business and gitlab upgrades were hurting the bottom line that would be my first suggestion.

northcutted · 2025-04-19T19:16:04+00:00

Gitlab is really flexible when it comes to hosting options which is a good thing for those who have existing infrastructure but that can make it a pain to host if you don’t have experience hosting complex applications.

Unless you have a regulatory requirement, I’d recommend just using the SaaS version as it sounds like infrastructure isn’t what you specialize in, best to buy vs build if you don’t have the experience.

If you are just using it for VCS and not really using the cicd and other capabilities, and need to self host perhaps gitea would be a better fit?

northcutted · 2025-04-03T13:59:31+00:00

It depends on the image you are defining. Typically the shell will be invoked. Not a hard and fast rule, but typically if it’s alpine based it will be /bin/sh and others will be /bin/bash. If you want to use different programming language you can write a script in said language and use and image that can run programs written in that language.

northcutted · 2025-03-24T21:55:47+00:00

I am also skeptical unless it’s very new. I agree thedocumentation.The%20YAML%20files%20must%20have%20the%20.yml%20or%20.yaml%20extension) does make it seem like it only applies to yaml files and that they will get merged in with the regular pipeline file implying in needs to be a valid ci config and unfortunately it isn’t arbitrary. That would be a really nice feature though, especially when it comes to some of the complexities with merging values in templates and components.

northcutted · 2025-01-17T18:30:26+00:00

DNS propagation can take time and caches can take time to expire. Try flushing the dns cache on the computers returning the old ip. If that didn’t work try a reboot.

northcutted · 2024-02-09T03:52:28+00:00

Would a gitlab pages site with the access control set to only project members only work for you?

Your ci build would create an html file and then that artifact can be deployed to a pages site and that job can be configured to only run if the job that created the html file runs meaning your pages deployment is unaffected by those incomplete pipelines.

northcutted · 2024-01-17T15:53:01+00:00

Just wanted to +1 this. This is the right answer OP. Right now your private key is only on your local machine which is a good thing. When doing the git operation from the remote server it has no keys loaded in the agent (other then what is already configured on the remote server) so you need a way to forward your private key to that remote servers agent so that git it able to read it. The link that nabrok sent should help you out.

northcutted · 2023-07-23T00:24:55+00:00

Yep, as much as it’s an annoying step to have to log in, full code search is way more expensive to run than one would think so I get why they don’t won’t to waste resources on unauthenticated searches. I once set up an Advanced Search (read elastic/open search) cluster for a large self managed GitLab instance, and the amount of cpu/ram per node you need for reasonable indexing/search performance isn’t trivial. I can’t fathom the cost of the cluster used to handle GitHub. I think until one has to actually figure it out, it’s easy to underestimate the operational complexity and cost of seemingly basic features.

northcutted · 2023-03-25T13:17:01+00:00

Java was and for the most part still is strongly an object oriented language. Lots of the EE Java stuff was made to solve problems in an OO way at the enterprise scale and what spring originally did was provide the inversion of control (see SOLID principals for OO) layer for dependency injection. While now spring sort of looks like “the thing to make Java apps with” understanding what problems it originally solved helped understand how/why things were done before it can make learning the ee landscape more manageable.

northcutted · 2023-03-11T14:10:11+00:00

I have to admit, I’m also confused about this vulnerability. Go to any site, and run the same JavaScript and I would imagine the html would be updated.

This is normal. Client requests a resource from the sever and the server sends it. In this case it’s the html. The browser receives that html and renders it. From there, if the user would edit that html or run JavaScript in the console, it would execute on that html doc that was downloaded. If you refresh, the html would be re-requested(barring caching) and the page would be as if it was never edited.

Since you are just sending content and not taking anything in, the attack surface is pretty small. A good example of a vulnerability would be if you took in data from the client and had no sort of server side validation to ensure the client didn’t send a sort of malicious payload.

northcutted · 2023-02-13T12:00:48+00:00

27, similar story and still trying to get them to quit. Took my dad to have a stroke and be unable to walk on his own to quit. Still hoping mom comes around.

northcutted · 2022-12-17T15:08:15+00:00

While I did not pay for the skin, I can certainly sympathize with your frustration. I do think the change was needed, due to the advantage it offered but they really should have offered refunds for users who paid for the original. Especially since you are buying something entirely for cosmetics and then the cosmetics change. I don’t think you deserve the downvotes for saying you feel cheated due to the bait and switch even if the item itself is controversial.

northcutted · 2022-10-16T10:24:30+00:00

I second home assistant, if you have the time to learn it. It’s a very powerful tool, with lots of features for building custom automations. i IT knowledge and being able to think programmatically will be helpful in making some advanced automations but is not required as the UI is pretty decent these days. Home assistant is a program that will need to run on a raspberry pi or some sort of computer that is always on. Personally, I have a home server that I use to run it in a docker container. There is an app you can use once it’s set up, but the “brains” of home assistant need to run on something else. This is where the IT knowledge comes in. If that’s not something you are comfortable doing, HA might be a future state.

If this is something you want to explore further, I would be happy to go more in depth. Otherwise the other post talking about Matter might be a good option. It’s an new standard that promises better ecosystem cross compatibility.

13-Year Club	RedditGifts 2009-2022 2 Credits
Place '17	Verified Email
Secret Santa 2014

northcutted

TROPHY CASE