grawity

short-lived tweets, and mostly retweets of 90s tech
|¦| probably also

[grawity @grawity]

@LOUDO_ there used to be an official "pc speaker as sound card" driver for Windows 3.11 https://t.co/LGwYcBqd3W

[grawity @grawity]

@turtlekiosk I have zero nostalgia for it because 1) it's not quite old enough & 2) we (well, another dept) still have to use a silverlight-based webapp at work in the year 2026

practically all it does is accept CSV uploads, and does it poorly, but for whatever reason it's silverlight-based

[grawity @grawity]

@hdais Cisco is very slightly different from Yost -- at least my Cisco 1760 has the DSR signal but not DCD; Yost has DCD but not DSR.

(I had to figure this out last week when trying to understand why "stty -clocal" was not working as it should...)

[grawity @grawity]

@_shyam_king_ once you've set up BGP and are receiving packets, what you do with them is all up to you.

e.g. the device can use all those addresses for itself (acting as a host), or it can route them into your LAN (acting as a router/gateway), or use them for vmbr0 or docker0, etc, etc.

[grawity @grawity]

@_shyam_king_ but "device that can speak BGP" is a very low bar – you can do BGP on a Linux host with Bird2 or FRR or openbgpd. Debian works, OpenWRT works, Opnsense also works. I like Mikrotik myself.

many hobbyists get a cheap IPv6 /48 for themselves and set up a few peerings like that.

[grawity @grawity]

@_shyam_king_ in which situation? do you mean when you get 1 static address from ISP? or do you mean when you buy a whole block from a RIR or a broker?

in the former case, "gateways" are not the issue in themselves; a gateway (router) on its own doesn't imply private addresses

[grawity @grawity]

@markrosganyu yes, but I meant, that's what it might cost for your ISP to provide static IP service (of course depending on how many spare addresses they have: some have plenty to spare, others might be forced to buy - or broaden cgnat - in order to free up some addresses for "static" users)

[grawity @grawity]

@markrosganyu directly from RIRs the membership cost wasn't big but the RIR pools are straight up empty. orgs have been sitting in queues for months, I think years even.

so the remaining source is second-hand, "slightly used IPv4" market, where public broker prices seem to be $30-50/address

[grawity @grawity]

@thatsyuribabe when I saw this I thought "wait a moment, I've definitely seen this somewhere else" and apparently they've done this exact scene before https://t.co/T3M3qz6kdY

[grawity @grawity]

@awakecoding I don't quite get the realm issue. I know AD uses lowercase for the UPN, but as far as I know it still enforces the actual Kerberos realm to be upper-case... and it's the client that decides which realm to use, anyway, so wouldn't it be enough to pass upper-case realm to kinit?

[grawity @grawity]

@awakecoding @BoreanJordan I mean, it is the same kind of situation as with regular KDC discovery (TCP/UDP), where everything used to rely on manual KDC hostnames in /etc/krb5.conf for a long time – until MS AD decided "let's use SRV records". (Now we have the opposite with AD relying on manual config...)

[grawity @grawity]

@awakecoding @BoreanJordan MIT Krb5 uses URI records: https://t.co/qj5iXqDPuA – afaik, FreeIPA publishes them by default. They're essentially a rebranded TXT with obligatory convoluted syntax, but... it does the job.

[grawity @grawity]

@BoreanJordan @awakecoding that kind of argument baffles me – needing the config option is very much a problem with the implementation, it is not something fundamental in the protocol. MIT Krb5 has had DNS records for KKDCP discovery for *years*, it is specifically Windows that lags behind

[grawity @grawity]

@awakecoding It's the GPO to disable NTLM, yeah

[grawity @grawity]

@awakecoding GnuPG also has its own protocol between gpg/gpgsm and gpg-agent, and another between gpg-agent and scdaemon (its smartcard backend); I'm not sure if it's sufficiently generic, although I expect it'd need to support X.509 cert retrieval for gpgsm.

[grawity @grawity]

@awakecoding p11-kit on Linux has an IPC protocol for accessing remote PKCS#11 tokens over a socket (serializing the entire PKCS#11 calls). I've used it to have "ssh -I https://t.co/oWkDrjkzIb" on my laptop use keys from an eToken inside my server.

[grawity @grawity]

@awakecoding Often the opposite: you paste the main website URL into the feed reader, it scans for <link rel=alternate> tags looking for either RSS or Atom type= (I usually find Atom easier to generate) and automatically adds the right feed. If there are multiple, often it lets you select.

[grawity @grawity]

@BoreanJordan I just connect it and the certs appear on their own, generally? i.e. CertPropSvc does the magic

(...unless I have some other manufacturer's smartcard middleware installed and it breaks that)