miniblog.

Sometimes, the best way to harden a service is to outsource it. I've dabbled with running my own CI service for PRs. Running *arbitrary* third party patches is scary. Malware! Crypto miners! It's really nice not having to worry about that.

Signify, OpenBSD's alternative to GPG, is really elegant: https://www.openbsd.org/papers/bsdcan-signify.html No key servers, a simple CLI, a crypto algorithm without random inputs that you can screw up, and readable keys!

I'm coming round to the view that services should avoid implementing their own username and password system. It's easy to screw up (cf crypto) such that a DB compromise leaks users' passwords for other sites. It's also more convenient for users, who don't need a pw manager.