rtxn

Four… Fucking… Pixels?

The working hypothesis is that this was some sort of debug or test key that was never meant to be used in production, being used in production.

The encryption that SSL/TLS provides (that puts the “secure” in HTTPS) uses a public–private key pair and a mathematical function that is easy to calculate, but difficult to calculate its inverse. Generating the key pair requires a cryptographically secure random number that is impossible or very difficult to guess, which must be kept secret at all times. If this random number is leaked or guessed by a malicious actor, the private key can be reconstructed and used to impersonate a website or break the encryption.

One of the factors that determine the security of the key is the size of the number, i.e. the number of digits. In this case, a proper key should’ve had a length of 384 bits (or 116 decimal digits). In reality, the keys that eMudhra used had eight bits, which can only represent 256 possible values, and can be easily guessed even by brute force. The specific private keys were the numbers 4, 56, 66, 115, 155, 156, 230, and 237.

Currently having a very fun day at work.

Not me. Call me old-fashioned, but I prefer organic.

Literally none of that should be surprising for people who have a basic understanding of how the WWW works.

i3-4160 running Proxmox (OPNSense VM and a couple of containers) with 3 spinny drives and no GPU, TP-Link 8x GbE switch, ASUS AX1800 as a Wifi AP, ISP’s own manky cable modem, plus a UPS eats about 66-72 watts at the wall socket. If I install a passively cooled GT-710 for transcoding, it adds 10-15 watts at idle.

I have this new AI tool. Free and open source, model and all, and extremely CPU-efficient. Basically you feed it the training data (like some New York Times articles, but it can be any text or binary), and it can produce a 1:1 output when prompted. I call it “copi”; can I get my five trillion tax dollars now?

CUPS didn’t work for me as I can’t see an upload option on the web UI.

And you won’t. For the purpose of printing, CUPS is a print server, not a web front-end. It facilitates communication between client devices and downstream printers.

Printing is implemented through IPP, which is an HTTP-based protocol. You have to add the URL of the printer as it appears on the web UI (e.g. https://print.mydomain.net/printers/PRINTER_NAME) as a printer in the client device’s printer manager. It’s plug-and-play on Linux and Mac, and needs a driver (even if it’s the generic PostScript driver) on Windows.

Now all I need is a way to remotely start a headless session and I can finally nuke X11 off my computer.

If you have IPv4 addresses, I guarantee you’re behind at least one NAT gateway. What you need is a Tailscale subnet router, or something equivalent from another service.

In the most basic configuration, the Tailscale client facilitates communication between one host it is running on and another host it is running on that are both connected to the same tailnet. For this purpose, it uses addresses from the 100.64.0.0/10 “shared address space” subnet. These addresses will only be reachable from within your tailnet.

If you want an entire subnet (e.g. your LAN) to be accessible within your tailnet, you need to set up a subnet router. This involves configuring the Tailscale client on a device within the target subnet to advertise routes (tailscale set --advertise-routes=192.168.1.0/24), allowing the host to advertise routes in the admin page (Machines -> … -> Edit routes), and configuring the Tailscale client on external hosts to accept advertised routes (tailscale set --accept-routes).

If you want your servers to be accessible from anywhere on the internet, you’ll need Tailscale Funnel. I don’t use it personally, but it seems to work.

I’ve had good experiences with Rustdesk. The client is open-source and the no-cost server components (ID and Relay servers) are self-hostable. The remote server works on X11 and Windows. I use this script to run XFCE+Rustdesk in a headless session:

export SERVERNUM=69
export SCREEN_SIZE='-screen 0 2560x1440x24'
export DISPLAY=":${SERVERNUM}"
export XDG_SESSION_TYPE=x11

xvfb-run --server-num="${SERVERNUM}" --server-args "${SCREEN_SIZE}" startxfce4 & disown
sleep 1
flatpak run com.rustdesk.RustDesk & disown

Sunshine + Moonlight is also a good choice. I have Sunshine installed on a box at home and use Tailscale to connect to it from the Moonlight client. At 1440p 60 FPS it has no visible compression artifacts and responsive enough for gaming.

@Mods, please don’t delete this. It’s a valuable lesson.