Kelsos

Kelsos

@kelsos.bsky.social

Open Source software developer. MusicBee remote, Full-stack rotkiapp, Android Hobbist and Vue.js dev

161 followers370 following38 posts

My "favorite" recurring security theater: a compliance scanner matches an OpenSSH version string, ignores the distro revision, and flags CVEs that were already patched. I write the dispute, attach changelog screenshots, it gets accepted. See you in 90 days when I have to re-report them...

Here is the wrong way for breaking api changes - announce breaking changes just two days before the release - keep the same version path - remove params without any deprecation window - reword error messages - roll it out slowly instance by instance so clients can't tell which behaviour they'll get.

I have been spending quite some time to try and deal with a lot of the known UI/UX technical debt in the app.

lefterisjp.bsky.social@lefterisjp.bsky.social

At the next big rotki release, thanks to @kelsos.bsky.social we are revamping the search + filter part of rotki's history view Now contextaware suggestions will be shown to you by starting to type something in the search filter! Always working to make your experience better! rotki.com/download

Kelsos reposted

I am really happy with this turned out. There are still quite a number of ux improvements I want to tackle in next releases.

lefterisjp.bsky.social@lefterisjp.bsky.social

For our next rotki release we are improving editing UX. When creating or editing history events you no longer need to deal with internal type/subtype. You just simply choose the event action directly from a searchable dropdown of all possible actions. You asked, we listened! rotki.com/download

Kelsos reposted

If you are on the latest pnpm v11.10.0 (or v10.34.5), you can try out the pnpm v12 alpha via: pnpm self-update 12.0.0-alpha.5 It is fully in Rust! 🦀

Every bit helps us keep building in the open :)

lefterisjp.bsky.social@lefterisjp.bsky.social

rotki got accepted into TheDAO Fund's Security QF round Every centralized tax tool is a honeypot of addresses, API keys and history. One breach makes you a target rotki eliminates that by design. All data encrypted and local In QF every donor counts. Please help us🙏 qf.giveth.io/project/rotk...

This is actually the first update in 5 years, finalizing a re-write that started almost 10 years ago fixing some decade long bugs too.

musicbeeremote.bsky.social@musicbeeremote.bsky.social

We are getting close to the new release. There is a new release candidate out, the website has been updated too, including the help guide. mbrc.kelsos.net/news/2026-04...

Honestly switching Nuxt to static from SSR and moving the server side code to go has been a terrific decision. Everything is faster, while it consumes less memory and storage.

In summer I got a new GPU. In December I contacted the retailer to replace it, since it had what it seemed like a manufacturing flaw. After a month I stopped getting updates. After I reached out (almost two months later) to ask when the for an update, they refunded. Is this normal in Germany?

On phone they claimed that the manufacturer was the one that could not resolve the issue, (repair or replace), forcing the refund. In Greece usually the retailer would confirm the fault and either replace it if the product was in stock or refund it if the product was not available any more.

Kelsos reposted

Good morning 🌨️ Wish you all a beautiful day ahead with a 📸 of a mallard seen in a Berlin park. 🇩🇪 Stockente | 🇵🇱 Krzyżówka | 🇬🇷 Αγριόπαπια | 🇺🇦 Крижень

So we got another failure in the "security scan" for PCI DSS compliance because they match OpenSSH CVEs against the upstream, ignoring the fact that LTS releases backport the fixes to older versions. Then I am asked to resent the e-mail, for "security" including information that it's already there.

I am looking about PCI DSS 6.4.3 and 11.6.1 compliance and it makes me angry. As angry as it makes me to have to relax Content Security Policy because otherwise "3DSecure" won't work because each bank has to run code on their own domain for this to work.

Kelsos reposted

1. Never manually enter your GitHub or npm password; use a Passkey instead. 2. Enable npm 2FA for both authorization and publishing. 3. Use trusted publishing and remove all npm CI tokens. 4. Only invite maintainers who follow these security practices.

Kevin Deng@sxzz.dev

All the packages affected by this attack had not enabled trusted publishing and provenance. - The top four packages were all impacted. - More than half of the top ten packages were affected. github.com/sxzz/npm-top...

Kelsos reposted

Vitest 4 runs simple test files faster! You can already check it out by installing Vitest 4 beta. On average, Vitest now takes 25% less time to start the test. Due to parallelisation, the overall time difference can vary. We are focusing our efforts on improving the time even more in the next beta!

Kelsos reposted

So the certificate costs more than 100$ on yearly basis, and if you want to use it on CI, say GitHub actions where you can not use a Yubikey, you have to use a subscription service that costs 20$ per month for 20 signings...

I wonder how other open-source projects deal with code signing on Windows. Originally we got a certificate for 5 years, due to industry changes, we were forced to re-issue it after 3. Now PFX is not available, and you can either pay extra for a singing service or an expensive hardware token.

Nothing really wakes you up in the morning than having to clean the glass you broke while making coffee, but I would still rather enjoy the coffee, even if it takes more time to wake up 😂