PSA: if you want to secure your home lab, you should make it only accessible through a VPN, however: do not be as foolish as me and think that a billion dollar company might have its shit together when choosing an auth-provider.

Thought I was real smart to use GitHub as my login but it turns out they have a worse uptime than my home server somehow and I cannot access it now.

THANK YOU FOR YOUR ATTENTION TO THIS MATTER

Hello people,

Lately I have heard a lot of good stuff about Leaseweb. Also it seems to be cheaper than Hetzner.

I have been using Hetzner for years but with all the price hike, I was wondering if its worth moving to Lease Web.

Anybody using Leaseweb and got a feedback?

Note: I'm using it to host client's websites and resell hosting services through Plesk.

My secrets have slowly turned into a mess. There are .env files on a few different hosts, some passwords pasted straight into compose files, tokens sitting in CI variables, and a password manager note I'm not proud of. Every time I rotate something I forget at least one place.

I've looked at the usual options. SOPS with age seems nice but key distribution and CI feel fiddly. Vault or OpenBao feel like a lot to run at home, especially the unseal part after a reboot. Infisical looks good but it's another app plus a database to keep updated.

What I actually want is pretty simple: one place per environment, some history so I can undo a bad change, tokens for CI that expire on their own, and something that doesn't need babysitting.

What are you all using, and has it held up? Also curious where you keep the very first secret, the one that unlocks everything else.

at the top of the screen its super annoying

My site recently had a failed hacking attempt but I don't understand why someone would try this way. In the space of 1 min, thirty or so log in attempts were made using mostly nonsensical usernames.

Normally I see one or two attempts with names like admin, or wphiddenbot (not sure why that) and then they stop.

But this was one was repeated numerous times, every time with a new username and one that is unlikely to be used such as 'guflhane'.

What is the logic in trying such attempts? The usernames seem so unlikely to be used anywhere, one or two were more realistic such as 'pv_admin', but none were the usualy suspects like admin.

Anyone else seen this?

EDIT: I think the point of my questions is getting lost. To clarify, I know it's bots, I also see lots of login attempts all the time. Most of the them are usually trying common usernames or names that might be associated with my site, or as I said I see some ones repeated like 'wphiddenbot'.

But my question was trying to understand what's the point in trying so many weird usernames, the usernames they tried were mostly very odd 8 to 10 letter strings

I've been trying to make our sales call follow-ups a little more consistent, especially when it comes to keeping the CRM up to date. The problem is that not every detail from a call is equally useful. Knowing that a customer had a 30-minute conversation with us doesn't tell the next person much, but knowing what was holding them back, what questions came up, and whether we promised to follow up makes a real difference.

We're looking at ways to use AI to handle more of the note-taking, but I don't want the team spending extra time correcting generic summaries. For those already using AI in sales, how do you get it to capture the details that help move a deal forward?

I've been trying to make our sales call follow-ups a little more consistent, especially when it comes to keeping the CRM up to date. The problem is that not every detail from a call is equally useful. Knowing that a customer had a 30-minute conversation with us doesn't tell the next person much, but knowing what was holding them back, what questions came up, and whether we promised to follow up makes a real difference.

We're looking at ways to use AI to handle more of the note-taking, but I don't want the team spending extra time correcting generic summaries. For those already using AI in sales, how do you get it to capture the details that help move a deal forward?

How PHP 8.6 is going to speed up your code

Apiiro scanned 104,185 public copies of .claude/settings.local.json on GitHub between Nov 1 and 3, 2026. 1,122 of them (1.1%) held at least one secret, 1,379 in total. Among them: 379 database passwords, 43 SSH logins, 42 GitHub, GitLab or npm tokens and 23 AWS keys.

The mechanism is in Anthropic's permissions docs. When a user picks "Yes, and don't ask again" on a shell command, Claude Code saves an allow rule in that file. If the prompt offered the exact command, any password typed into it is saved in plain text. Claude Code adds the file to the user's global git excludes, but that covers one machine only, and nothing goes into the project's own .gitignore. In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file.

gitleaks caught 564 of the 1,122 files and TruffleHog 643. Neither caught 215. Most misses are passwords after PGPASSWORD=, sshpass -p or mysql -p, which look like ordinary words to a scanner built for key formats. Apiiro sells security products and did not test whether the secrets work. One company it notified confirmed its key was live.

Rotate first. Then run git rm --cached .claude/settings.local.json and add the file to the repository's .gitignore. Older versions stay in history: Apiiro found 734 more secrets there that no current copy holds.

Do you scan agent config files for secrets, or only source code?

Sources: Apiiro research (Nov 5), The Hacker News (Nov 7).

I’m looking for a cost-effective VPS provider for one of my systems. I’m currently using GreenCloud, but they’ve had too many outages recently, causing frequent issues in my production environment. Does anyone have recommendations for a more reliable provider?

I’ve checked Vultr and DigitalOcean—they are great providers, but their pricing isn't quite budget-friendly for me.

Thanks a lot for your time!

I built hoist, a small push-to-deploy tool for one Linux box (systemd + Cloudflare Tunnel, Python stdlib). To keep myself honest I installed Dokploy on the same laptop and deployed the same Dockerfile app through both, polling the public URL every 50 ms:

• push to live, median of 6: 1.54 s vs 2.53 s
• downtime during swap: 0.00 s vs ~0.1 s
• broken build: old version keeps serving on both

The first run, hoist lost (0.65 to 1.45 s gap during rollover). The fix was a small TCP front that owns the public port and only switches once the new container answers HTTP. Method, raw logs and bugs found are in docs/benchmark.md.

One laptop, one competitor: a method, not a verdict. I'd like critique on the method more than the tool.

Built with AI assistance (Claude), designed and tested by me.

https://github.com/nikhilcherry/hoist