My kid just started college about 800 miles from home. He's kind of spoiled the way that I think most middle class suburban Gen Z kids are kind of spoiled, but so far I think he's doing a decent job of managing his own life. We talk once a week and text one another occasionally, but I'm trying hard to give him credit for having a brain unless he demonstrates otherwise.

A lot of the other parents, though... I haven't seen social media helicopter parent bullshit like this since these kids were all in middle school with masks on and plexiglass dividers between the seats. There's a FB group for my kid's freshman class and every day there's some new "outrage" that parents are losing their shit over.

The shower curtains in my kid's dorm are mildewy.

The dining hall ran out of chicken strips.

Every kid on my kid's hall is sick.

Have you seen this arrest report from the town police blotter?

Did any of these people ever live in a college dorm??? Yes, the bathrooms are kind of gross, yes, the dining halls run out of shit sometimes, yes, respiratory illnesses run through a dorm like wildfire and yes, college kids do dumb shit and sometimes the police get involved. None of this is a scandal or a national emergency. What ever happened to the generation that was always like, whatever?

Hola.. Soy una chica de 19 años, vivo en la calle y ando buscando trabajo. Tengo los 2 carnet, hablo ingles nativo/fluido pero no he terminado la secundaria. No tengo economia para pagar la secundaria (hasta las publicas son caras, tuve que salirme porque ya no pude con todo los gastos). He aplicado a todo y siempre me dicen que no porque no tengo diploma. Hasta call centers y comida rapida (mcdonald y burger king) me han rechazado por no tener diploma. Alguien sabe algun trabajo/empresa/lugar que te acepte sin diploma aqui en la ciudad de Panamá??

Hace unos años estuve en un proceso de selección y me quedé con la duda de como es trabajar alli. Que tal la cultura? Salarios? Beneficios?

I have been aggressively migrating from AWS permanent credentials to OIDC in GitHub Actions, mainly for deploying to ECS.

I know GitHub Actions were supporting OIDC for a while now. But the pressure on compliance is the reason for this migration.

If you are new to OpenID Connect (OIDC), it allows GitHub runners to mint short-lived (15–60 min) STS tokens on-the-fly with zero stored secrets.

Here’s a quick breakdown of how it works, the Terraform/OpenTofu setup, and the subtle gotchas that I faced.

1. How It Works Under the Hood

1. When your workflow job starts with id-token: write, GitHub's OIDC service generates a cryptographically signed JSON Web Token (JWT).
2. The aws-actions/configure-aws-credentials action sends this JWT to AWS STS via sts:AssumeRoleWithWebIdentity.
3. AWS validates GitHub's signature, checks your IAM Role's Trust Policy (to ensure the token came from your exact repo and branch), and returns temporary STS credentials.

2. The Infrastructure Setup (Terraform / OpenTofu)

You only need two AWS resources: an OIDC Provider and an IAM Role with a Trust Policy.

hcl # 1. The GitHub OIDC Identity Provider resource "aws_iam_openid_connect_provider" "github" { url = "https://token.actions.githubusercontent.com" client_id_list = ["sts.amazonaws.com"] thumbprint_list = [ "6938fd4d98bab03faadb97b34396831e3780aea1", "1c58a3a8518e8759bf075b76b750d4f2df264fcd" ] } # 2. IAM Role with Scoped Trust Policy resource "aws_iam_role" "github_deploy_role" { name = "github-actions-deploy-role" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [{ Effect = "Allow" Principal = { Federated = aws_iam_openid_connect_provider.github.arn } Action = "sts:AssumeRoleWithWebIdentity" Condition = { StringEquals = { "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com" } StringLike = { # Restrict exclusively to your repository & branch/tags "token.actions.githubusercontent.com:sub" = "repo:your-username/your-repo:*" } } }] }) }

3. The GitHub Actions Workflow

In your .github/workflows/deploy.yml

name: Deploy to AWS on: push: branches: [ main ] jobs: deploy: runs-on: ubuntu-latest permissions: id-token: write # CRITICAL: required to request the OIDC JWT contents: read steps: - name: Checkout code uses: actions/checkout@v4 - name: Configure AWS Credentials via OIDC uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy-role aws-region: us-east-1 - name: Verify Authentication run: aws sts get-caller-identity 

Three real-world gotchas that will save you hours

If you get Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity, check these 3 things:

1. Case Sensitivity in the sub claim: AWS IAM condition strings are case-sensitive. If your GitHub repo or username uses mixed casing (e.g. MyOrg/Repo), make sure your IAM sub condition matches the exact casing GitHub sends in the token. Using wildcard matching (repo:MyOrg/Repo:*) helps avoid exact ref string mismatch issues.
2. Job-Level vs. Workflow-Level Permissions: Always set permissions: id-token: write on the specific job, not just globally at the top of the YAML file. Some runner configs don't inherit top-level permissions to nested jobs.
3. CA Thumbprints: Don't dynamically query GitHub's leaf certificate for thumbprints in Terraform—they change frequently with CDN updates. Use GitHub's official intermediate root CA thumbprints:
   • 6938fd4d98bab03faadb97b34396831e3780aea1
   • 1c58a3a8518e8759bf075b76b750d4f2df264fcd

Summary

• No stored secrets in GitHub settings.
• No key rotation schedules to manage.
• Granular security. You can restrict deployment roles to specific branches or environments.

Are you already using OIDC for your pipelines, or are you still relying on IAM users? Curious how folks here handle multi-account / cross-account OIDC setups.

Estimada comunidad, queria consultar en donde y aproximadamente el costo de prueba de Paternidad, y si estas son funcionales para presentar como evidencia en un juicio.

Muchas gracias gente.

These SQL injections have been coming in daily to this site which has still seemingly managed to avoid infection simply because of the changed database prefix. This one uses the “author not in” query bug inside some crazy nested query to place the payload in the database.

This is all related to the WP2Shell bug which was reported over a month ago. The site had auto updates disabled and still managed to avoid getting infected because of some seemingly silly security practices like changing table names and database prefixes. As far as I can tell all of these failed. I was alerted to the issue because the site got locked in a loop of timeouts, perhaps related to these malformed queries. Unfortunately I’m going to have to do some kind of a forensic workup even though there were no clear indicators of compromise because requests to the batch endpoint resulted in many 207 codes which means they may have succeeded.

But when I saw the giant block of 0s and 1s and hex codes in the logs, my heart dropped into my stomach. Stay safe out there people and leave auto updates on. It’s worth the chance of breaking your site every once in a while.

Recently I had an idea for a research tool, I realized I'd need to be able to find websites programmatically and the webs data is behind the largest corporations, not something we reliably have access to for being able to develop around.

So it got me thinking, how lightweight could you first build a crawler if you only cared about getting meta data (titles, description and the url)? Then it got me thinking, could we not share the load, create a distributed peer to peer network and make this data decentralized?

So what I have built is the open web directory. A network that crawls and builds a yellow pages like directory for web pages online.

You can setup your own node and contribute to the network by simply running:

git clone https://github.com/idev-games/the-open-web-directory.git cd the-open-web-directory npm start 

And open port 80 for that device by port forwarding.

I think this is going to be a fascinating experiment, it's early days so expect bugs and issues but give it ago and let's see if we can index the web.

Check out more info here:

https://github.com/iDev-Games/The-Open-Web-Directory

The site listed on github is the live front end (you can host the html files in the public folder anywhere to open another frontend on the web).