Recent content on Martin Baillie
Image promotion In my experience, an organisation working with container images in any form will typically have a runtime supply chain that first takes an image from an “untrusted” origin (e.g. a public upstream or the organisation’s own permissive development registry), then scans its contents for attributes classified non-compliant to the organisation’s security posture,…
Fool Me Once I have been keeping a wee .org file of gotchas in the defaults of Go’s various net packages for a while now. I pull it up each time I’m building a service with the standard library, just to make sure I don’t miss something that I have already hit in the past. Let’s call it learning from one’s mistakes where the one in question has a shocking memory.
Cattle not pets The majority of AWS EC2 I need to operate these days are members of Kubernetes clusters. For remote access to them I’m more commonly authenticating to the Kube API to spawn a privileged ephemeral debugger pod rather than accessing the host directly. I have little need for host access even for the remaining minority of ancillary EC2 services I’m responsible for because…
Making a touchpad work on Linux as well as it does on macOS/Windows. It’s a problem as old as time itself, or at least as old as the “year of Linux on the desktop” meme. The days of calibrating obscure values that I don’t fully understand on the old X11 synaptics driver were supposed to be a thing of the past with libinput, and to be fair they have been, for the most part.
The typical modern software supply chain starts with an input changeset of source commits triggering a whole raft of manual and automated code checks in a CI environment: peer reviews; full testing pyramid; dependency vetting; automated static analysis and so on. The outputs of this step are invariably deployable artefacts such as binaries, container images, interpreted/byte code archives or IaC…
I recently revisited Rust after a few years hiatus and in one project I found myself needing to provide a different Server Name Indicator (SNI) when initiating a TLS connection to a remote host. In Go this is as simple as setting the ServerName field on the standard library’s TLS configuration struct. (&http.Client{ Transport: &http.Transport{ TLSClientConfig: &tls.Config{ ServerName:…
WASM I have had a renewed interest in WASM ever since I read the Mozilla WASI announcement and some of its supporting literature. A few things clicked for me after that, most prominently the potential for use beyond the browser. The compile once, run anywhere aspects echo the Linux container revolution of the last decade, but with true sandboxing, faster starts and without the baggage of a Linux…
I made the switch to Emacs last year after having been a resolute vim user ever since I dual booted Slackware on my family’s first computer as an early teen. Needless to say the power of the Emacs pseudo lisp machine quickly opened my eyes. I immediately lunged into consolidating practically all my text use cases sans browsing into Emacs: programming, note taking, RSS, mail, git porcelain,…
Nix Early last year, after teetering on the edge for a while, I finally took the plunge into the world of Nix. It always seemed to be the logical conclusion to my declarative over imperative leanings and it has not disappointed. I would classify myself as a semi-retired OS bikeshedder these days. I no longer obsess over ricing my prompt nor switch tiling WMs like they’re going out of style.…
I have been continuing to run with Tailscale instead of hand-cranked WireGuard on various devices, including my daily driver ThinkPad which runs my other favourite OS—NixOS! However, until now the configuration was not particularly idiomatic due to there being no upstream Tailscale Nix expressions in nixpkgs. As it transpired, Dan Anderson of Tailscale is also a NixOS user and with his support I…
Tailscale A service called Tailscale launched at the beginning of the month and promises to be the “easiest, most secure way to use WireGuard and 2FA”. As an early beta tester of WireGuard and someone who has been carefully tracking its progress towards mainline Linux (currently in net-next, scheduled for 5.6!), I am especially excited to see people much smarter than me start to build…
UPDATE: The plugin described in this fieldnote was recently demoed at HashiCorp’s Hashitalks 2021. GitHub I have found that performing automation against GitHub APIs often necessitates the creation of OAuth Tokens (nb. GitHub refers to these as Personal Access Tokens or PATs). These tokens are tied to a user account, have very coarsely-scoped permissions and do not expire. The more…
Well here we are! I had held off from spewing words onto the internet in long-form until now. That I have made it this far with a new site and first post has been the culmination of: The compound guilt felt as a practiced user of other people’s technical writing to my professional advantage. The accidental consumption of multiple “why you should write a technical blog”-themed…