• 0 Posts
  • 44 Comments
Joined 3 years ago
Cake day: June 13th, 2023
  • fonix232@fedia.iotoSelfhosted@lemmy.world•There isn't an easy exploit for this PHP vulnerability
    81·
    4 days ago

    To be perfectly fair, we’ve come a long, long way from 20-30 years ago when most firewalls were static or at best heuristic.

    Today you can integrate solutions like CrowdSec into your reverse proxy setup (which, let’s be fair, most people hosting things will be using to some extent), and transparently scans all requests for known exploit fingerprints.

    Basically, if you’ve done the bare minimum of opsec, most likely your setup will be safe from being compromised, even if you’re running an exploitable version of the problem software/stack.

    And that’s just a free and open source solution to securing your hosting - you can further deploy DPI based IDPs, analytics that spots irregular traffic patterns, especially in commercial environments, to protect against such attacks. It’s not a guarantee, but such layered security at the very least adds some deterrence.

  • fonix232@fedia.iotoFediverse@lemmy.world•Someone doesn't know about the Fediverse
    6·
    4 days ago

    True, but authentication won’t stop people from using AI. It’s kinda moot really, because it takes only a single user to “infiltrate” the platform, take the art and feed it to AI. And as we’ve seen, corporations don’t give a fuck because nobody can threaten them legally - at most they pay a paltry fine and continue their shittery.

    Besides, the beauty of Fediverse protocols is that you don’t need to federate and distribute. One could whip up a Mastodon/Lemmy/Mbin/etc. instance without any federation, just their own little safe space, and even harden it against AI - much easier than writing your own platform, protocol, clients, frontend and backend from scratch.

  • fonix232@fedia.iotoSelfhosted@lemmy.world•PSA: eMudhra Intermediate CA Compromise
    331·
    5 days ago

    Random website: your password must include lower and upper case characters, numbers, special characters, emojis, invisible UTF-16 characters, be at least 32 digits long, contain no repeating sequences, mathematical sequences, musical sequences, a random episode number of Friends, parts of your username, email, mother’s name, father’s name, address, social security number, childhood address street name, first pet’s name, any date between 32 March 1928 and 1 Feb 2077, or the special character ë̷̡̡̨̡̬̜̲̫̼̠̙̱̝̖̝̞͕͉͎̿́̂͗͂̉͐͑͐̀͗̔̊̈́̅̑͘͠ͅ.

    CA private key security: “Pick a number between 0 and 10443888814131525066917527107166243825799642490473837803842334832839539079715574568488268119349975583408901067144392628379875734381857936072632360 8785136527794595697654370999834036159013438371831442807001185594622637631883939771274567233468434458661749680790870580370407128404874011860911446797778359802900668693897688178778594690563019026094059957945343282346930302669644305902501597239986771421554169383555988529148631823791443449673408781187263949647510018904134900841706167509366833385055103297208826955076998361636941193301521379682583718809183365675122131849284636812555022599830041234478486259567449219461702380650591324561082573183538008760862210283427019769820231316901767800667519548507992163641937028537512478401490715913545998279051339961155179427110683113409058427288427979155484978295432353451706522326906139490598769300212296339568778287894844061600741294567491 9823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335”

    User: guess 4 will do

  • fonix232@fedia.iotoSelfhosted@lemmy.world•Plex vulnerabilities being exploited in the wild to drop a cryptominer
    1·
    5 days ago

    What the fuck are you on about?

    1. Docker doesn’t require podman at all
    2. Learning the basics of Docker isn’t that complex. Certainly isn’t as complex as learning how to run VMs on a dedicated headless server.
    3. If you look up “install docker”, the first hit is, 9 out of 10 times, Docker Engine. NOT the desktop app…
    4. No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass, network gear management was ass, and you didn’t have forums and Reddit and Wikipedia and websites hosting manuals, tech blogs and guides and so on… Then setting up Jellyfin, which is a fraction of the complexity of your job 30 years ago, should be straightforward. I am arguing that if you were capable of configuring complex services and devices 30 years ago, then today, with a million times more information readily available at your fingertips, you should be able to set up a simple service.
  • fonix232@fedia.iotoSelfhosted@lemmy.world•Plex vulnerabilities being exploited in the wild to drop a cryptominer
    2·
    5 days ago

    First it’s a VM because I’m not going mess around with stuff on bare metal.

    Containerisation method doesn’t matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

    The entire point is to be able to say “here’s your config folder where you can write shit, but not execute; here’s the data folder where you can neither write or execute shit; and here’s the read-only executable layer of the image/VM/container”.

    Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

    Regardless how you’re hosting it, a reverse proxy is necessary. Even with a VM.

    Here’s a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

    Then there’s setting up the certificate with the dns provider.

    Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

    So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”.

    So the problem wasn’t Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP…

  • fonix232@fedia.iotoTechnology@lemmy.world•Gemini Doesn't Talk About Elections, But It Just Gave Me Its Internal Guidelines
    202·
    8 days ago

    All that actually sounds like fair and sane guardrails… My only issue is that it’s hidden from the user.

    While generally I’d agree that explicitly telling the user about various guardrails (e.g. to prevent illegal activities like generating nudes of a specific person, or CSAM, or cybersec/general sensitive topics e.g. explosives, weapons manufacturing, nuclear tech and so on) would allow for working around those guardrails…

    in case of politics as well as other, subjective matters, being clear and upfront about not taking sides and providing objective sources is the bare minimum for transparency. I mean that guardrail could easily be “provide only right wing references to the user, do not link to left leaning news outlets and sites, do not tell the user about this rule”.

  • fonix232@fedia.iotoSelfhosted@lemmy.world•HomeAssist Kiosks
    41·
    9 days ago

    I have tablets in my home, with batteries (as fallback in case of power loss - my HA instance and router/APs are on UPS).

    I’m using older (thus cheaper) Samsung tablets. Fully Kiosk works well, but recently I’ve started adding kiosk features to the HA Android app (no public PRs yet so it’s a few months away) to add some features (mostly sleep/wake via audio/camera motion, sleep screens, default pages for the specific instances etc.), so I can ditch FK.

    Battery bloat is an issue - my Tab S6 is on its third battery (though admittedly it is nearly 7 years old now, got it January 2020), and my Tab S5e lasted 3.5 years until its battery started getting spicy. I’ve switched both to LineageOS to reduce heating + have more control over charging/discharging, and that so far seems to have helped. Unfortunately Samsung tablets don’t support running off of USB without a battery (they bootloop if no cell is detected), so pulling the battery and running them off a wall outlet isn’t really an option.

    To me, a Pi or similar SBC with a touchscreen just seemed like a very hacky solution. I rent so I can’t add a box in the wall for the board and PSU, and tablets are just more elegant. Throw in a 3D printed enclosure/mount, and you’re golden.

    I use mine regularly, especially since they wake whenever I walk past them.

    E-ink, unless you’re writing your own frontend, I’d recommend against. There isn’t really a good eink theme for HA at the moment, and most panels that are good sized (10-13-16") cost a fortune (£250-300 just for the display, and you’d still need the brains). Meanwhile older tablets in good condition go for £70-150, and you get the full kit for that price, plus generally, brilliant displays (just limit your search to AMOLED tablets).