DoD (DoW whatever) has been running the CAC PKI infrastructure for over 20 years, and believe me a good deal of their three quarters of a million employees have no idea what PKI or keypairs are but use it to log into their workstation and do all sorts of online identity validation every single day.
https://www.cac.mil/common-access-card/
I'm not saying the gov is competent in general btw, but they are actually far better about this area than private industry, in my direct experience.
it would likely be built into the ID, like a PIV/CAC card. I thought about this same thing many years ago, the state DMV's could be in a PKI web of trust with a federal signer/issuer/cross-signer above them. Proving your identity online would mean inserting your ID into your computer so it could be crypto-graphically validated. Yes there are genuine privacy and other concerns, but we'll probably end up there anyway and could have avoided all the mess of having these crappy third party for profit companies involved. The tech already exists, and has existed for some time.
> the mess of having these crappy third party for profit companies involved
I think the problem that lots of people, including all the people involved in those companies, don't think that's a problem but a feature. Adds "jobs", GDP, filling their own pockets and a whole host of other "benefits" they're willing to look past any drawbacks in order to get.
This is essentially how my Estonian ID card works. The ID card is inserted into a USB smartcard reader and grants access to identity verification an thus access to services.
But the American public is petrified of systems like that because of the leftovers of frontier settler culture and fear of communism. They're apparently far more comfortable with the similar but worse systems being set up by corporations.
Government is wasteful and could never run an efficient [Industry]. Instead, private companies that can be efficient should run [Industry]. They will be more efficient [and turn the surplus into private profits instead of public savings].
> Yes there are genuine privacy and other concerns,
Not for government services. The only problem is if the government makes it overly easy for private companies to integrate with and make use of the system. Pretty much no website except perhaps my bank or health care provider have any business collecting my PII.
>so much saner than Linux firewalls it's not even close.
This is a big one for me. I've run openBSD and Linux custom boxes as SoHo routers and I just cannot stand Linux firewalls, I've never liked them and IPTables is just terrible. Yes I know there are wrappers around it now but it's still the default everywhere and still used by lots of other software like Docker. I'm using OPNSense now which is FreeBSD based instead of completely rolling my own but I love that it is still BSD under the hood.
One differing opinion I will offer is that I find NixOS to be the Linux distro most in the openBSD spirit despite it being very different from a UX and config management perspective. Alpine is interesting, but it has its own security and compatibility issues, especially around MUSL libc which I have had cause many strange downstream issues over the years, I just hit one recently in JVM GC caused by its memory allocation implementation. I've stopped using alpine altogether because of them.
Feel the same way about COVID. It damaged the social fabric in ways that have not recovered. I think a lot of people realized that maybe they never really liked socializing as much as they thought they did. I also think it just kind of reset people's expectations around socializing. The other big one to me, that it also unleashed, was inflation. Dining out, sporting events, concerts etc are all way more expensive than they used to be. Places are still busy and games are still packed but the prices are way higher, more evidence of the K shaped economy where only the top stratas are spending. Also, and this is subjective, it feels a bit more performative, as in people are going because it signals they have the means (edit: and the general instagram-ification of our culture.)
The damaged social fabric - for me - didn't consist of spendy stuff. Just backyard BBQ's, pool parties, (hosted) brunch or dinner invitations, that sort of thing. You keep doing it because habit. But then a 2 year interruption because of COVID, habit broken and before you know it you haven't talked to some people for 5 years and now it would be awkward to call them up again...
Restaurants realized they were leaving a lot of money on the table pre-Covid. Post-Covid has seen restaurants raising prices more aggressively, cutting staff, cutting condiments, replacing menus with QR menus, cutting employee and business hours, etc.
The post-Covid real estate/tech/AI /white-collar job/quant boom has led to inflated salaries, wealth inflation and higher prices to match, and then combined with various supply chain shortages and disruptions, e.g. (many tariffs, Israel v Iran v Russia v Ukraine wars and tensions, etc.).
If I paste something from an AI into chat, I always identify it as such by saying something like "my claude instance says this:". I also don't blindly copy paste from it, I always read it first and usually edit it for brevity or tone. Feel like this should be the absolute minimum for sending AI content to a person.
Even that is pretty useless because we have no idea what context "your Claude instance" has. All you're doing is dressing up some bullshit to look authoritative.
When I started my PhD I was already really good at typesetting with LaTeX. I started to bring in fully typeset works in progress for my supervisor to read through. These proofs often had fatal flaws. He asked me to stop typesetting until after the work had been verified because it looked too convincingly correct due to being typeset.
That was about 15 years ago but I've never forgotten it. Drafts should look like drafts. Scrappy work and proofs of concept should look as such. Stop fucking with people by making your bullshit, scrappy ideas look legit. Progress is a cooperative effort. It's not about trying to make people say yes.
Can confirm. I saw some fresh out of college colleagues do this in text docs. Al nice markup, but the text content was very drafty. I always sent them back to keep the format concept-y if you are tuning the text first.
Extremely debatable. They still have never fully implemented health checks and auto healing. I have had compose itself behave in unexpected ways, weird things like not realizing the tag of an image it is running is actually in use, and letting prune commands yank it out from under the system. Other things I can't remember. I'd rather use something like Nomad or for simpler systems maybe plain systemd. But realistically kubernetes is a superior orchestrator in just about every way, and installing k3s is simple and k3s is actually production ready. I don't like kubernetes all that much as cluster tech, but as a container orchestrator it has a lot of nice features.
I'm totally onboard with k3s/k8s being better in a lot of cases.
But docker compose can actually be very sufficient for what many projects actually need.
Granted I am a guy pushing for compose based localdevs and such but going further you often just cannot beat the simplicity of doing update QA or other CI/CD workloads in compose based projects. I have had dozens of projects where we replaced flaky slow and maintenance heavy pipelines with just docker compose up --build --wait in the past years. How come you say health checks are still broken?
I do use compose for some things, smaller one off type setups, and I’ve done the compose up --build CI/CD approach before. I’m generally not a fan of building on the production node outside of very small deployments. It can work, I just think it tends to blur the line between build and runtime more than I’m comfortable with.
Some of my concerns with compose aren’t purely technical. It makes it easier to lean on local state like volumes, bind mounts, and large .env files. Similar mechanisms exist in kubernetes, but the additional setup tends to force a bit more thought about whether they’re actually needed or just a shortcut.
On the health check side, they exist, but compose doesn’t fully act on them, that's the part that is missing. There’s no built in remediation or orchestration behavior tied to health status, which is why things like
https://github.com/willfarrell/docker-autoheal exist. It’s something that was never fully carried through in Docker itself.
> Extremely debatable. They still have never fully implemented health checks and auto healing.
Agree.
Plus there's the monitoring of the host that is always overlooked in articles. I've ended up chucking Monit on there to monitor disk usage et al, and also used it for monitoring compose too and restarting containers.
And then there's Healthchecks.io, and external uptime monitoring... the list goes on. Properly monitoring systems, even single server systems, is not simple.
