Why do we do all these efforts making our build systems hermetic and we end up just using a global mutable cache across branches where the caller picks the key? Failure of industry as a whole. Actually insane.
Working on the foundation of this (getting Wire deployed at and certified by the BSI) was my first job out of college 7 years ago and how I ended up in Berlin. And once you end up in Berlin you can never leave, it seems.
I was actually on site at the Bundeskanzleramt and they had requirements of being able to install the entire server stack airgapped. We ended up building quite a cool delivery method based on Nix to ship the whole closure of the system and the containers inside and spin up a Kubernetes cluster with it. I'm wondering if it is still being used.
Yeh. But wire's storage is based on Cassandra which handles replication of storage. So you could deploy it on local nvme drives as well using a local storage CSI.
That's also how the wire.com cloud is/was run. Large Cassandra cluster on top of EC2 Instance Store as opposed to EBS.
The earliest doc I can find quickly shows that the BSI already recommended Wire in 2021 (at least; couldn't find anything earlier). The actual authorization seemed to have happened some time in 2024, but it's possible that just nobody asked for the formal approval before that.
What I'm saying is - just because the BSI authorizes something, doesn't mean that it has to reach the Bundestag ;)
That's not true. Both AWS' as well as GCP's workload identity tokens are not bound to the VM. If you leak the credentials they're valid until they expire. on AWS the expiry is 6 hours (non-configurable). Even if your IAM role has a shorter expiration, the credentials assumed by the VM will always be valid for 6 hours.
That entirely depends on the location of the proxy and the extra conditions you can express. E.g. you could bind it to a source IP and have the proxy check that, or use some overlay network (like tailscale does)
My point was that you don't literally have to run the proxy on localhost in order to scope the request.
Just a heads up: I know it's cool to generate ASCII art with Claude code these Days but for some reason checks the output? Non of the diagrams in the article look correct to me. They all have spacing issues?
You're probably seeing an Android bug. The default Android monospace font borks the spacing of box-drawing characters. It's been like that for several years. EDIT the same thing might happen on some niche Linux distros
Were they generated by D2? I tested naive generation without extra hints/layout settings, and its ascii charts leave a lot to be desired (including worse artifacts than that, like creating too-narrow charts and text overwriting other text that's too close). SVG output might have been much better.
reply