Re: [OT] how secure is 2 factor auth with a smartphone?

> Re: [OT] how secure is 2 factor auth with a smartphone? Not very much. Phones are easy to lose, break (which means 2nd factor recovery must be relatively painless == lowest common denominator), etc. For services that insist on 2FA, I have a script that calls oathtool and copies the code to clip

Re: Fail2ban alternative for OpenBSD

On Mon, 30 Oct 2017, Zbyszek Żółkiewski wrote: > that’s naive, did you trusted it when there were weak ssh keys > generated back few years ago ? I am not here to teach anyone about > good practices, but having ssh closed is just common-sense. It was Debian's screwup, not OpenSSH's. Call me naive

Re: Fail2ban alternative for OpenBSD

> I am wondering since years why the hell people left SSH port open to > the word? Because I trust OpenSSH.

Re: Fail2ban alternative for OpenBSD

On Mon, 30 Oct 2017, Gregory Edigarov wrote: > On 29.10.17 03:20, x9p wrote: >> >> Coming from the Linux world, I wonder if there is a better alternative >> to fail2ban, already being used in OpenBSD servers by the majority. >> > I suggest you NEVER use such "solutions". It's security by obscurity

Re: Need to swap partitions: /tmp amd /usr

On Sun, 29 Oct 2017, Jay Hart wrote: > Good Evening Fellow OpenBSDers, > > Below is currently how I have my disk laid out partition wise. I have a > feeling I need to swap > /tmp and /usr in order to gain additional space for /usr. > > What is the best way to go about that? Boot system from ram

Re: Flask app as UWSGI returning 500 when accessed through OpenBSD HTTPD

I Am Not A uWSGI Expert, but the way we've been usually setting it up is via plain HTTP reverse proxying, never CGI/FastCGI. I would try that approach first.

Re: Automatically restarting services/daemons after crash

Hi Aaron & misc@, My take: I favor a tool that gives me (the end-user) more power. OpenBSD folks are 100% right to maintain a particular policy (no automatic restarts), but I see no reason to enforce it by taking away options from the end users. (Furthermore, I see no reason to attack a tool or

Re: Can I rotate the framebuffer (e.g. using wsdisplay) in OpenBSD?

On Wed, 27 Sep 2017, Francois Pussault wrote: > maybe installing a tool like xrandr ? Xrandr works only for X. I've skimmed wscons(4), wsdisplay(4), wsconscfg(8), wsconsctl(8), nothing about rotation...

Re: OT: protonmail mail body

On Wed, 12 Jul 2017, Rupert Gallagher wrote: > I top post deliberately, out of sympathy. When you will be as old as I > am, you will find that scrolling a long thread to read a reply it > pains your hand. So, to avoid top posting, you have to scroll twice: > to read, and to write. I people top pos

Re: Robust ThinkPad suggestions for running OpenBSD.

For lightweight, go with X2.0 series. I've used X200s (OpenBSD, Linux), X220 & X250 (Linux), and can recommend all of these. X230 is supposedly also decent, and can be modded with the old X220 keyboard. Avoid X240, it has a very shitty touchpad. For sturdy, go with any older model, up to & includi

Re: Limits on OBSD amd64

On Fri, 26 May 2017, Stuart Henderson wrote: >> and ZFS ? > > 0 bytes. -1 bytes and ENOENT? :)

Re: Etnernal & infernal browser woes

On Fri, 28 Apr 2017, Anders Andersson wrote: > From what I read, it seems as if the problems are mostly from when you > try websites which are heavy on javascript. Let me butt in as a grumpy > not-so-old man and point out that there's nothing even remotely > "secure by default" by even allowing ja

Re: softraid mirror & large drives (3T)

On Tue, 18 Apr 2017, Jiri B wrote: > On Tue, Apr 18, 2017 at 08:23:56AM -0400, Allan Streib wrote: >> Buy a hardware RAID controller. > > I suppose you wanted to write - 'buy two equal hardware RAID controllers', > or how would you be solving problem in broken hw raid controller in > cca 10 yrs fr

Re: Is there something to replace zaurus?

On Tue, 04 Apr 2017, Kristoff Haler wrote: > Hello misc@, > > Unable to provide direct link from this email account > Search indiegogo "gpd-pocket-7-0" > Not ARM, > x86_64, > 8GB RAM, > TrackPoint, > 7in 1920x1200, > Touchscreen, > Gorilla Glass, > This "feels" OpenBSD. > > Regards, > Krist

Re: better way to detect new display

On Wed, 01 Mar 2017, Marcus MERIGHI wrote: > sc...@ggr.com (Scott Bonds), 2017.02.28 (Tue) 02:21 (CET): >> I'm polling using xrandr to check whether a new display was plugged >> in, so I can run a script to switch to it, i.e. plug in an external >> VGA monitor and it lights up automatically, unplu

Re: Looking for replacement of thinkpad x201

Long time user of X200s, most beloved machine ever. Took a lot of beating, even a Thinkpad wouldn't stand it. Took it apart for spare parts. Screen is pretty poor compared to X220 and newer. Currently on X250, and I like it. The keyboard is bearable but takes some adjusting to. Got an X220 (the l

Re: https for pkg_add?

On Mon, 09 Jan 2017, Stuart Henderson wrote: > Performance won't be ideal though, there's no pipelining or session > resumption - it needs to do a full TLS negotiation for each package > fetched (note that pkg_add -u fetches at least the start of the tgz > for *every* package which you have instal

Re: Making motd great again

On Mon, 21 Nov 2016, trondd wrote: > If you want the MOTD to be aimed at users who may not have much Unix > knowledge yet, then the sysadmin can change it to whatever makes sense for > their environment. Consider the first-time user experience for a person that just installed OpenBSD on their own

Re: Correct shebang for Python 3

On Sun, 23 Oct 2016, Stuart Henderson wrote: >> #!/usr/bin/env python > > Opinions vary but I'm not a fan of using env for this, I don't normally > want to trust the first file of that name found in the path. There are two kinds of people: those that know exactly what their $PATH is, and those wh

Re: 2 files, same name, same dir

On Sat, 22 Oct 2016, Nick Holland wrote: > (and it wouldn't surprise me if Linux "saves" you from this error, and > it would just make me hate it all the more) No need to kick the poor penguin... > $ uname > Linux > $ mkdir /tmp/test > $ cd $_ > $ touch "pi.c" > $ touch "pi.c " > $ ls | hexdump

Re: security(8) doesn't know about mailbox locks

On Fri, 21 Oct 2016, Philippe Meunier wrote: > When cron runs /etc/daily, that script runs df and netstat and the > output is sent by email to root. On my system, emails to root are > forwarded to local user meunier using /root/.forward. The forwarding > itself temporarily creates a lock file in

Re: DigitalOcean and OpenBSD

On Thu, 25 Aug 2016, Uwe Werler wrote: > Now they offer a rescue boot with OpenBSD 5.9 too. It's quite easy to > install a new machine now. And a very plus it their support. Wow, this is good news and very, very cool. (For those who, like me, are a bit lost: it's not in the "Rescue" tab, but in

Re: DigitalOcean and OpenBSD

On Thu, 25 Aug 2016, Gilles Chehade wrote: > There are other alternatives with better hardware, services and policies > within the same price ranges. online.net to name one, hetzner.de to name > another one. Hetzner customer here. Hetzner doesn't support OpenBSD natively. The only instructions I

Re: Installer overwrites partition table

On Wed, 24 Aug 2016, Bertram Scharpf wrote: > Hi, > > first of all, I am an experienced OS installer and I did a > heck of partitioning in my life. Now I had some unused disk > space and I found it a good idea to install OpenBSD. > > The installers partitioning tool didn't offer me a variant > tha

Re: Logging/backup .ksh_history

On Mon, 08 Aug 2016, Francois Pussault wrote: >> >> From: Craig Skinner >> Sent: Mon Aug 08 09:49:11 CEST 2016 >> To: >> Subject: Re: Logging/backup .ksh_history >> >> >> Hi John, >> >> On 2016-08-08 Mon 14:39 PM |, johnw wrote: >> > Hi, I use /bin/ksh as

Re: Thinking about writing something I'm calling wifid

On Tue, 02 Aug 2016, Theo de Raadt wrote: > The kernel should have a better way of exporting stations it knows about > live, rather than userland forcing channel hops and station changes out > of sync with the kernel. Perhaps overloading kevent? EVFILT_IEEE80211?

Re: Native C written i2pd port for OpenBSD

Short answer: you'll probably have to get your hands dirty and help port it. Open an issue, talk to maintainers, see what you can do to help. On Thu, 21 Jul 2016, Denis Lapshin wrote: > Hi there. > > Looking for a OpenBSD port of PurpleI2P/i2pd C written project (non java > version). > Github li

Re: choosing OpenBSD for fileserver instead of FreeBSD + ZFS

On Wed, 20 Jul 2016, Theodoros wrote: > +1, zfs and hammer are great filesystems for such a use. > > Looking forward to RAID10 support on softraid (!). Been running "manually stacked" RAID10 with 6 drives, on a low-traffic production system, for half a year. System boots off the first RAID1 array

Re: choosing OpenBSD for fileserver instead of FreeBSD + ZFS

On Wed, 20 Jul 2016, Miles Keaton wrote: > So I figure if I use OpenBSD + softraid RAID 5 (across 4 disks) and then > write my own little shell script to track the MD5 (find . -type f -exec md5 > {} \;) whenever I make changes, that should be enough to see if a file has > been changed due to disk

Re: How make "pkg_add" auto-choose some package version for me when same package is available in more versions?

On Mon, 04 Jul 2016, Chris Bennett wrote: > Don't want to rebuild your production web/business servers? > Look up Mtier in the mailing list. Nice helpful infrastructure. Yes, I use their services both at work and at home. > Not to sound like I'm kissing ass, but you really should look at the > i

Re: How make "pkg_add" auto-choose some package version for me when same package is available in more versions?

On Mon, 04 Jul 2016, Marc Espie wrote: > YES, they're all wrong. There's a BIG difference between running new > shitz in a test setup vs running "bleeding edge" in production. I think we're confusing two different concepts here... Latest stable release (with most recent security patches) vs follo

Re: How make "pkg_add" auto-choose some package version for me when same package is available in more versions?

On Sun, 03 Jul 2016, Raul Miller wrote: > And then there's the use case of untangling the mess when this did the > wrong thing. Well, I think nobody here argues that a program, if facing a hard decision, should throw an error rather than corrupt the system. I'm well aware, things that run fine o

Re: How make "pkg_add" auto-choose some package version for me when same package is available in more versions?

On Sun, 03 Jul 2016, Chris Bennett wrote: > This can't be done and should NOT be done. if you are asked to choose > between two+ different versions, often that choice is based on the other > package(s) that depend on a particular version. You may even need to > install both versions when two of yo

Re: I am not sure if it is a problem with OpenBSD's httpd

Oh my god, just realised TTRSS is a self-hosted web app... makes sense, Stuart is right - it must be the chroot...

Re: I am not sure if it is a problem with OpenBSD's httpd

> Arrived to this point, could be a problem with OpenBSD's httpd daemon > that runs in chroot?? None of the symptoms you've described has anything at all to do with local httpd, or any other web server you might be running locally. > But when I try to resolve DNS googleprojectzero.blogspot.com

Re: A patch for cal

On Tue, 21 Jun 2016, Abu Unaysah wrote: > January 2016 > Su Mo Tu We Th Fr Sa > 31 1 2 > 3 4 5 6 7 8 9 > 10 11 12 13 14 15 16 > 17 18 19 20 21 22 23 > 24 25 26 27 28 29 30 The reason this happens on commercially available, wall-hung calendars is because they are all tryin

Re: No slip anymore?

On Wed, 08 Jun 2016, Roderick wrote: > If you have a very old laptop with a comfortable keyboard, then > minix is a good alternative to use the laptop for example as a > typewriter (and much more than that). Does your typewriter with 32 MB of RAM have Ethernet? I remember occasionally browsing th

Re: wifind(8) find your wifi

Perhaps it's time that the best tool be chosen and made a part of the base install? I've already seen like a 100 different OBSD WiFi scripts floating around the 'net, and naturally I also have a DIY one.

Re: wifind(8) find your wifi

On Thu, 02 Jun 2016, Ray Lai wrote: > use JSON::PP; That's just my personal opinion, but JSON sucks for configuration files. It's more of a human-readable data interchange format. It feels like the same functionality can be achieved with something much simpler, getent or CSV style. > my $tmp =

Re: hardware recommendation for openbsd-based thin client?

I have an alix 2d3 (no vga) running on 5.9 as a jumphost for ssh. It's slow. It's *very* slow. Usable more or less only as a router, firewall, jumphost, ntp, etc that sort of appliance. If you'd like, I can run some benchmarks for common tasks like pkg_add or a compile, so you can get an idea. On

Re: Suggestion: new webpage for openbsd.org

On Wed, 18 May 2016, Joakim Frostegård wrote: > I think it's more important to have good mobile support than perfect > console browser support. Actually, bad mobile support is one of the > biggest problems with the current site. You have to cater to your audience... I'm quite sure there are many

Re:

sed -i

Re: TLS now supported on openbsd.org?

On Tue, 10 May 2016, Giancarlo Razzolini wrote: > Until every UA is changed to first try TLS and *only then* fall back > to clear text http, this kind of measure has its uses. This is of limited usefulness. All you need to do (as a mitm) is to block the connection on port 443, client will now au

Re: letsencrypt (Was: Re: TLS now supported on openbsd.org?)

On Tue, 10 May 2016, Ingo Schwarze wrote: > Hi Kristaps, > > Kristaps Dzonsons wrote on Tue, May 10, 2016 at 11:37:42AM +0200: > >> (1) download ... couldn't find ... didn't require bash >> (2) aforementioned script in a cronjob >> (2b) user to have access to >> (3) doas rule >> (4) doas rule >> (

Re: Comprehensive user's/programmer's manual for OpenBSD: Do they exist?

On Sat, 07 May 2016, David Lou wrote: > I wasn't able to find such a thing but perhaps I just missed it. I > am wondering if anyone in the community knows whether such manuals > exist for OpenBSD. Manpages are nice but they're not what I'm looking > for. Trying to learn OpenBSD by looking up indiv

Re: Pledging Python programs

On Mon, 02 May 2016, Tobias Borgert wrote: > Hello misc, > > I wanted to look into Python C extensions and as I also wanted to look > at pledge, the following was the result. > > [...] > > I didn't expect it to work even for basic examples, so I wanted to share > this as I was surprised that it wa

Re: Create a RAID5 with a disk marked as degraded

On Fri, 29 Apr 2016, Karel Gardas wrote: > On Fri, Apr 29, 2016 at 2:38 PM, Kamil Cholewiński wrote: >> Silly, tangentially related question, perhaps someone knows an answer: >> >> Is there a considerable performance impact to be expected when using an >> odd number

Re: Create a RAID5 with a disk marked as degraded

On Fri, 29 Apr 2016, Karel Gardas wrote: > On Fri, Apr 29, 2016 at 10:20 AM, Erling Westenvik > wrote: >> On Fri, Apr 29, 2016 at 09:49:14AM +0200, Karel Gardas wrote: >>> Also for creation of RAID5 you need minimally 4 drives. >> >> Make that 3. :) > > I stand corrected! Mistake caused by my tes

Re: Create a RAID5 with a disk marked as degraded

On Fri, 29 Apr 2016, Benton Lam wrote: > Hi, > > I currently have a 5.7 box, with 2 disk RAID1 (comprise of sd1a and sd2a) > > Suppose I upgrade / install to 5.9. Is it possible for me to do the following: > > bioctl -O /dev/sd2a sd3 # degrade the raid1 (sd3) > bioctl -c 5 -l /dev/sd1a,/dev/sd2a,/

Re: Not enough Memory!

On Mon, 25 Apr 2016, Mohammad BadieZadegan wrote: > Hi everybody, > I want to install wireshark but my memory was full! > Is that a way to increase /dev/sd0h? > Regards. Do you have any unallocated disk space? "disklabel sd0" should show us your disk layout. Easiest is to use this unallocated sp

Re: Creating a blog using OpenBSD: technology choices and security considerations

On Tue, 26 Apr 2016, ra...@openmailbox.org wrote: > If you want to make a dynamic "web application" then consider using > ur/web [1]. The programming language itself protects against SQL > injection, XSS attacks, CSRF attacks. I hate to bring the bad news, but this language / framework has close

Re: Creating a blog using OpenBSD: technology choices and security considerations

On Tue, 26 Apr 2016, li...@wrant.com wrote: > Reality check, structured text presentation beats any sort of generator: > > [https://en.wikipedia.org/wiki/Lightweight_markup_language] I agree with using an LML, but that's just one piece of the puzzle. There are numerous converters available: - htt

Re: Creating a blog using OpenBSD: technology choices and security considerations

On Tue, 26 Apr 2016, David Lou wrote: > Hello, > > This is my first post. :) I suppose this is a high level kind of > question. > > When I say 'blog', I'm referring to a website that contains > essentially many pages of content. Each content page has attributes > such as title, date, category, tag

Re: Odd (incorrect?) zsh output

On Sun, 17 Apr 2016, Geoff Wozniak wrote: > # zsh -c 'x=$(false); echo $?' > 0 Same thing here, same arch/release, different hardware: > $ uname -mr > 5.9 amd64 > $ sysctl hw.vendor hw.product > hw.vendor=Dell Inc. > hw.product=PowerEdge T20 > $ zsh -c 'x=$(false); echo $?' > 0 > $ pkg_in

Re: bioctl disk encryption

On Sun, 10 Apr 2016, Matt Schwartz wrote: > I really like the bioctl full disk encryption feature. I would love to see > it extended to support multiple users/passkeys. I once worked with a > commercial full disk encryption product that allowed this and could even be > managed over a network. Comi

Relative performance in "stacked" RAID setups

Hello, I have a couple Dell machines to play with, both with OpenBSD 5.[89] and some sort of "stacked" RAID setup, involving crypto, mirroring and striping in various orders. I've decided to play a little benchmark game and share some numbers. Machine 1: 5.8, PowerEdge 2970, Opteron 2378 (8 core

Re: faq12.html

On Wed, 30 Mar 2016, Rob Pierce wrote: > For your consideration. > > Index: faq12.html > === > RCS file: /cvs/www/faq/faq12.html,v > retrieving revision 1.125 > diff -u -p -r1.125 faq12.html > --- faq12.html29 Mar 2016 01:27:3

Re: HTTPS Only 3.1 (Detailed Analysis, Browser Security, Open Source, Python)

On Thu, 24 Mar 2016, Kevin Chadwick wrote: > BTW, only allowing Javascript to come from the primary domain over SSL > would be a far saner idea, but lets see you get that past Google, > facebook and all the other tracking sites? It's possible with content security policy[1][2], but completely opt

Re: /usr/games/hack

On Tue, 15 Mar 2016, Raul Miller wrote: > On Tue, Mar 15, 2016 at 3:04 PM, Kamil Cholewiński wrote: >> I didn't suggest it to be enabled by default. Administrator's choice. >> Users can spawn private instances. No more dangerous than installing >> openarena-serve

Re: /usr/games/hack

On Tue, 15 Mar 2016, Theo de Raadt wrote: >> > You obviously cannot make them private, because that destroys inter- >> > terminal games, and you cannot remove the common data because it is the >> > game status data. >> >> The rest of the gamedev world seems to handle this situation by >> splitting

Re: /usr/games/hack

On Tue, 15 Mar 2016, Black Rider wrote: > El Sun, 13 Mar 2016 20:17:00 +0100, Theo Buehler escribió: > >> On Sun, Mar 13, 2016 at 02:06:54PM -0500, Edgar Pettijohn wrote: >>> On current I get the following when starting 'hack' >>> >>> "Cannot get status of hack" >>> >>> It worked on 5.8 release.

Re: What do you use to manage contact info?

On Fri, 04 Mar 2016, Joe Er wrote: > What do you use to manage your contacts? I am currently using the > address book in Thunderbird and am wondering if there is something that > is better. A file named ~/.people, with one entry per line: Firstname Lastname

Re: hostname | /etc/hosts

On Thu, 25 Feb 2016, Stuart Henderson wrote: > On 2016-02-24, Kamil Cholewiński wrote: >> This. See how Google bought '.dev'. >> >> https://tools.ietf.org/html/rfc2606 > > was cheaper to buy the TLD to prevent anyone else from grabbing > it, rather than c

Re: hostname | /etc/hosts

On Wed, 24 Feb 2016, Peter Hessler wrote: > On 2016 Feb 24 (Wed) at 12:59:04 + (+), Craig Skinner wrote: > :Hi Rodrigo, > : > :On 2016-02-24 Wed 10:48 AM |, Roderick wrote: > :> > :> Should the name in /etc/myname include a domain name? Even when I > :> do not have a static IP registered

Re: GUI Designer

If your program / tool mainly operates on lines of text, you absolutely must check out dmenu . You can write a program launcher, ssh launcher, file manager, music player, copy to clipboard, password vault, Wifi selector, todo/calendar app, web bookmarks manager, l

Re: Firefox W^X isn't a part of Pwn2Own contest

On Wed, 17 Feb 2016, Lampshade wrote: > Does original Firefox compiled by Mozilla running on Windows > have W^X? I bet: no, it doesn't. > I run browsers on the other user account in OpenBSD. Do you also sandbox the browser with some sort of remote desktop, or run under a separate X session? AFAIK

Re: can't run multiple instances of httpd, flags not visible in processes

On Thu, 28 Jan 2016, Paolo Aglialoro wrote: > When this goes implemented, how will one start/stop/reload/check the single > instance or all instances through /etc/rc.d/ ? I hate to repeat myself, but runit solves all of these problems cleanly, with no need for ps grepping, with no patches in the

Re: can't run multiple instances of httpd, flags not visible in processes

> Or is there any other way to distinguish between two httpd instances? Try runit: http://smarden.org/runit/

Re: Daily cron error in 5.7

On Mon, 25 Jan 2016, Craig Skinner wrote: > Hi Luciano, > > On 2016-01-24 Sun 19:52 PM |, Luciano wrote: >> run-parts: /etc/cron.daily/logrotate exited with return code 1 > ^ ^ what are these? > > $ man run-parts > man: no entry for run-parts in the manual. Look

Re: if I were to make a pkg-add diff

On Mon, 04 Jan 2016, Janne Johansson wrote: > What you meant was thousands of users sending handful of pings across > the world to a lot of the mirrors each time they (re)restart pkg_add? http://packages.debian.org/unstable/net/netselect-apt http://http.debian.net/

Re: Is a gmail/text-flow dmesg better than no dmesg?

> (not compatible with 2-factor auth). Citation needed? App-specific passwords work.

Re: Highest Speed Network Packet Generator?

You should have a look at Snabb Switch. I haven't tried it myself yet. On Sat, 26 Dec 2015, Mohammad BadieZadegan wrote: > Hi everybody, > I need a network packet generator that generates Network Packets with the > HIGHEST Speed! > Before I migrate to OpenBSD I used PKTGEN on Linux to generate th

Re: BIOS call fallback

> Somebody who installs OpenBSD and cannot access the internet now has a > double problem 1) he can't access the internet 2) he therefore can't > search online for information about how to fix the problem. IF you're installing a new and unknown OS on your only Internet-capable device - you are *as

Re: text-mode gui

> Back about 2008 I had my own way of downloading and installing, still > with the stock installer. I'd download some files and put them on a > CD, using the install floppy image as a boot image. Boot the CD as a > floppy, shell out and mount it as a CD, then go back and install from > a mounted

Re: text-mode gui

ymbols, >> > and users barely see the information between these on another terminal >> > capability controlled device, just and only: > > On Mon, 21 Dec 2015 00:16:02 +0100 Kamil Cholewiński >> >> A DSL. > > Get out of your ideas inception hat. If you di

Re: text-mode gui

> Usability means then it should be not only humans but also programs > who are able to interact with the installer. So, since stream editors > know nothing about this seasons' (or Luddite's) line drawing symbols, > and users barely see the information between these on another terminal > capabilit

Re: mupdf / mutool

On Thu, 17 Dec 2015, Jan Stary wrote: > On Dec 17 03:28:38, tre...@india.com wrote: >> You can write a script wich execute mupdf and send the the route of the >> directory containing the >> pdf to a file in /tmp with the $pid of mupdf in the name. Then you can use >> your wm's key bindings >> (o

Re: /bsd: athn0: device timeout

> In doubt try an older but reliable Mainboard/Hardware/Bios. Modern > Mainboard/Hardware/Bios CAN make difficulties. Agree and agree. I've had a vaguely similar experience in 2014 with a combination of Debian 7, a "latest and greatest" mobo, a noname PCIe USB3.0 card, a 15m USB extension cable, a

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

> The official CDs have the signify key physically printed on them. You press a new CD, print a new cover, etc. > If you want to rely on third parties, I can send you a copy of the > signify keys, signed by my PGP key. How would that help you at all? Sounds reasonable to me.

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

> The official CD set contains the signify keys for that release and the > next one. Once you have a known good copy of one set, you can always obtain > future ones securely. > > You don't even need to use the CD set to install, just as a way of obtaining > the signify keys with a high degree of c

Re: python uwsgi port/package

> I looked at runit but the documentation bills it as a replacement for > init which I find to be very heavyweight. Am I missing something about > runit, like a way to use it to manage a set of processes under init? It can replace init or it can happily co-exist with it. If you only need service s

Re: python uwsgi port/package

Everything boils down to whether you'd like to run more than one app on your box. > While I love pip and virtualenv in development, I don't understand the > advantage they offer over the system package manager on a production > machine. Easy: whenever you can't be bothered with proper containers.