PSA: if you want to secure your home lab, you should make it only accessible through a VPN, however: do not be as foolish as me and think that a billion dollar company might have its shit together when choosing an auth-provider.

Thought I was real smart to use GitHub as my login but it turns out they have a worse uptime than my home server somehow and I cannot access it now.

THANK YOU FOR YOUR ATTENTION TO THIS MATTER

Hello people,

Lately I have heard a lot of good stuff about Leaseweb. Also it seems to be cheaper than Hetzner.

I have been using Hetzner for years but with all the price hike, I was wondering if its worth moving to Lease Web.

Anybody using Leaseweb and got a feedback?

Note: I'm using it to host client's websites and resell hosting services through Plesk.

My secrets have slowly turned into a mess. There are .env files on a few different hosts, some passwords pasted straight into compose files, tokens sitting in CI variables, and a password manager note I'm not proud of. Every time I rotate something I forget at least one place.

I've looked at the usual options. SOPS with age seems nice but key distribution and CI feel fiddly. Vault or OpenBao feel like a lot to run at home, especially the unseal part after a reboot. Infisical looks good but it's another app plus a database to keep updated.

What I actually want is pretty simple: one place per environment, some history so I can undo a bad change, tokens for CI that expire on their own, and something that doesn't need babysitting.

What are you all using, and has it held up? Also curious where you keep the very first secret, the one that unlocks everything else.

I've been trying to make our sales call follow-ups a little more consistent, especially when it comes to keeping the CRM up to date. The problem is that not every detail from a call is equally useful. Knowing that a customer had a 30-minute conversation with us doesn't tell the next person much, but knowing what was holding them back, what questions came up, and whether we promised to follow up makes a real difference.

We're looking at ways to use AI to handle more of the note-taking, but I don't want the team spending extra time correcting generic summaries. For those already using AI in sales, how do you get it to capture the details that help move a deal forward?

How PHP 8.6 is going to speed up your code

Apiiro scanned 104,185 public copies of .claude/settings.local.json on GitHub between Nov 1 and 3, 2026. 1,122 of them (1.1%) held at least one secret, 1,379 in total. Among them: 379 database passwords, 43 SSH logins, 42 GitHub, GitLab or npm tokens and 23 AWS keys.

The mechanism is in Anthropic's permissions docs. When a user picks "Yes, and don't ask again" on a shell command, Claude Code saves an allow rule in that file. If the prompt offered the exact command, any password typed into it is saved in plain text. Claude Code adds the file to the user's global git excludes, but that covers one machine only, and nothing goes into the project's own .gitignore. In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file.

gitleaks caught 564 of the 1,122 files and TruffleHog 643. Neither caught 215. Most misses are passwords after PGPASSWORD=, sshpass -p or mysql -p, which look like ordinary words to a scanner built for key formats. Apiiro sells security products and did not test whether the secrets work. One company it notified confirmed its key was live.

Rotate first. Then run git rm --cached .claude/settings.local.json and add the file to the repository's .gitignore. Older versions stay in history: Apiiro found 734 more secrets there that no current copy holds.

Do you scan agent config files for secrets, or only source code?

Sources: Apiiro research (Nov 5), The Hacker News (Nov 7).

I’m looking for a cost-effective VPS provider for one of my systems. I’m currently using GreenCloud, but they’ve had too many outages recently, causing frequent issues in my production environment. Does anyone have recommendations for a more reliable provider?

I’ve checked Vultr and DigitalOcean—they are great providers, but their pricing isn't quite budget-friendly for me.

Thanks a lot for your time!

I built hoist, a small push-to-deploy tool for one Linux box (systemd + Cloudflare Tunnel, Python stdlib). To keep myself honest I installed Dokploy on the same laptop and deployed the same Dockerfile app through both, polling the public URL every 50 ms:

• push to live, median of 6: 1.54 s vs 2.53 s
• downtime during swap: 0.00 s vs ~0.1 s
• broken build: old version keeps serving on both

The first run, hoist lost (0.65 to 1.45 s gap during rollover). The fix was a small TCP front that owns the public port and only switches once the new container answers HTTP. Method, raw logs and bugs found are in docs/benchmark.md.

One laptop, one competitor: a method, not a verdict. I'd like critique on the method more than the tool.

Built with AI assistance (Claude), designed and tested by me.

https://github.com/nikhilcherry/hoist

Im planning on buying a webdomain soon to run a few projects and i just want to make sure i am able to do it i am planning on buying with ventraip since i can verify with my medicare card. just want a second opionion

I've been using WPBakery for years and have bought 21 "lifetime" licenses over time. I regret every single one of them at this point.

The update process is a fucking nightmare. It's been bad for years. As a "lifetime" licensed user you can't just update from the WP dashboard if you don't have a support license. I don't need support. I just need to update the plugin. But to do that simple task, you have to log in to the WPBakery site, find your version/license and then download a ZIP. This ZIP has to be unpacked and transferred to your site. And ofcourse the site breaks for a few seconds in the process

How can this be right? In Denmark we have this saying: "May your ass itch and your arms be too short to scratch it." – The late stage capitalist scumbag at WPBakery that came up with this should have the biggest itch and the smallest arms IMO.

Mi hermano ganó (su proyecto fue aprobado) en toy no toy en su última edición que transmitieron por telémetro y Mayer le ofreció $15k para invertir en su proyecto, hasta el día de hoy todo fue un teatro y nunca hicieron nada en apoyar, taquillaron todo eso y no apoyaron los emprendimientos, no solo fue mi hermano, ninguno de los otros participantes se llevó nada, toda una estafa en la que lucraron con eso, con la imagen de los participantes y se llevaron toda la plata de los patrocinios de empresas grandes que participaron.

Que burla, alguno más tiene información?