ntfy VS msquic

Slightly related, but I've also been working on and off for a few years on my own Type 1 Diabetes management solution (https://github.com/algao1/iv3).

I haven't had time to work on it recently, but it uses ntfy (https://ntfy.sh/) to send alerts and such.

I was thinking of eventually incorporating some kind of automatic remedial solution eventually to help keep my glucose in range, but haven't had any time to look into it yet.

If you go to the settings, there should be a notification category, which then contains another menu "App Notifications" where you can see all the apps that are allowed to receive notifications, but I don't know if this will stop google play services to receive these identifiers.

I use GrapheneOS, so I don't have any google play services running, but for the apps where I need notifications I use https://unifiedpush.org/ (only a few apps implement it) and I host my own https://ntfy.sh server.

Kind of similar, in the early days of COVID, I accidentally discovered that my state's website would have test results available several hours before they sent out the "view your results" email. So I made a script that would check the site every five or ten minutes and then ping me as soon as the result changed to something besides PENDING.

In the course of that I stumbled on https://ntfy.sh/ which solved the notification problem without needing Twitter, and I've used it since then to let me know when long-running scripts complete.

I connect any app that supports https://unifiedpush.org/ to a self hosted https://ntfy.sh instance for fully self hosted push notifications

changedetection.io just donated to the awesome crew over at ntfy.sh

For further monitoring & alerting about critical cpu temperatures (unlikely now) for example, I plan to use notify & something else. Haven't thought about this much yet though.

I've started tossing https://ntfy.sh/ alerts into my Deno apps to get push notifications for things I'm interested in

ntfy.sh

If it was for fun and to learn how, that's fair. But are you aware of https://ntfy.sh?

I referred to sockets as an API design, not to express an opinion on whether you should place your protocol implementations inside or outside the kernel. (Although that’s undeniably an interesting question that by all rights should have been settled by now, but isn’t.)

Even then, I didn’t mean you should reproduce the Berkeley socket API verbatim (ZeroMQ-style); multiple streams per connection does not sound like a particularly good fit to it (although apparently people have managed to fit SCTP into it[1]?). I only meant that with the current mainstream libraries[2,3,4], establishing a QUIC connection and transmitting bytestreams or datagrams over it seems quite a bit more involved than performing the equivalent TCP actions using sockets.

[1] https://datatracker.ietf.org/doc/html/rfc6458

[2] https://quiche.googlesource.com/quiche

[3] https://github.com/microsoft/msquic

[4] https://github.com/litespeedtech/lsquic

The documentation of MS QUIC says it is cross-platform, it should work on Linux, it has a CMake preset for Linux and you can download the prebuilt binary releases for Linux.

Hello HN, my name is Varun, and I am the co-founder of StepSecurity. Here is the backstory about Harden-Runner. We thoroughly researched past software supply chain security incidents. The devastating breaches of SolarWinds, Codecov, and others, have one thing in common – they attacked the CI/ CD pipeline or the build server.

These incidents made it clear that a purpose-built security agent was needed for CI/ CD. While there are numerous agents available for desktops and servers, such as from CrowdStrike and Lacework, none have been tailored specifically to address the unique risks present in CI/CD pipelines.

With the understanding that a specialized solution was needed to secure CI/CD environments, we developed Harden-Runner, an open-source solution tailored specifically for GitHub Actions hosted runners. It can be seamlessly integrated into your workflow by simply adding a step. The agent installation process is also lightning-fast, taking no more than 5 seconds to complete.

Harden-Runner's security agent is designed to closely monitor all aspects of the workflow run, including DNS, network, file, and process events. This allows for real-time identification of any potential security breaches. To prevent incidents like the Codecov breach, where exfiltration of credentials occurred, Harden-Runner allows you to set policies that restrict outbound traffic at both the DNS and network layers. Additionally, we are actively working on implementing further restrictions at the application layer, such as using HTTP verbs and paths, to provide an even more comprehensive security solution.

An excellent example of how Harden-Runner effectively blocks outbound traffic can be found in the following link: https://app.stepsecurity.io/github/microsoft/msquic/actions/.... As you can see, all traffic to unauthorized endpoints is highlighted in red, indicating that it has been blocked; this is because these endpoints are not included in the allowed list defined in the GitHub Actions workflow file, which can be viewed here: https://github.com/microsoft/msquic/blob/aaecb0fac5a3902dd24....

One of the key features of Harden-Runner's monitoring capabilities is its ability to detect any tampering or alteration of files during the build process, similar to the SolarWinds incident. To further enhance security and protect against potential malicious tools or attempts to disable the agent, Harden-Runner includes a disable-sudo mode. This mode effectively disables the use of 'sudo' on the hosted runner, providing an additional layer of protection

Harden-Runner has already been adopted by over 600 open-source repositories: https://github.com/step-security/harden-runner/network/depen.... To fully understand the capabilities of Harden-Runner and how it can protect against past supply chain attacks, please try out our attack simulator GitHub repository at https://github.com/step-security/attack-simulator. I would love to hear your feedback.

https://github.com/microsoft/msquic (QUIC / HTTP3)