moonpiedumplings
@moonpiedumplings@programming.dev
- Comment on NaiHe – lightweight E2E encrypted chat over any self-hosted MQTT broker 2 days ago:
You and your peer agree on an encryption key (any string).
This is unacceptably unsecure for the usecases you mention. There is a reason why the most secure messaging apps don’t use symettric encryption, don’t use passphrases, and they also possess forward secrecy.
It’s pointless to push this as a censhorship circumvention method
I appreciate the projects, but use of this to bypass
- Comment on a VPN that is easily self-hostable and resistant to blocking? 5 days ago:
Also try wireguard over port 53. Often (udp) traffic to port 53 is unblocked because it’s needed for DNS.
What is special about this setup is that it can sometimes get around captive portal wifi.
- Comment on a VPN that is easily self-hostable and resistant to blocking? 1 week ago:
hides as regular HTTPS traffic so it’s not blockable by Firewalls
From OP’s post, of course. If OP does not need to evade firewalls that are that aggressive, then they should have settled for a less stealthy VPN solution, as many of these HTTPS proxy solutions have performance and usability (can often only proxy TCP traffic) tradeoffs.
- Comment on a VPN that is easily self-hostable and resistant to blocking? 1 week ago:
Many of the prominent https VPN protocols are for evading the great firewall of China. OP had that as a requirement, so it is not an unreasonable assumption.
If you are evading less locked down firewalls, then you don’t need as stealthy VPNs.
- Comment on a VPN that is easily self-hostable and resistant to blocking? 1 week ago:
Yes because they are all designed to evade the great firewall of China, which automatically catches almost all other VPN’s and proxies.
Github is blocked in China. The fact that these repos are on Github and in Chinese is proof of their effectiveness.
- Comment on [deleted] 1 week ago:
If you are not a Gitea customer, you are not being informed of security updates in a timely manner:
Gitea repeatedly makes choices that leave Gitea admins exposed to known vulnerabilities during extended periods of time. For instance Gitea spent resources to undergo a SOC2 security audit for its SaaS offering while critical vulnerabilities demanded a new release. Advance notice of security releases is for customers only.
forgejo.org/compare-to-gitea/#security
Also, ForgeJo was promising federation which is still a WIP several years later.
Oh no, it doesn’t do the big feature™. I guess it’s unusable now.
I wish people would realize that software still works and is excellent even without the various flagship features. I use Kubernetes on a single node. I know there are people who use matrix without federation and e2ee because it’s actually a really good chat app, it just struggles with the performance demands of federation, and the e2ee ux isn’t quite there yet.
- Comment on [deleted] 1 week ago:
Yes. But this is a lot. It may be easier to use Forgejo’s built in migration tools, to copy over repositories along with their issues and other info. You would have to rebuild the admin parts of the site, like “organizations” and user privileges. (Well if you are using oauth and mapping users from oautb groups then you don’t…). And I don’t know if it’s automated for a many, many repos. But it’s just a click click click in the gui.
I remember there was a tool, I think it was related to forgefed, that could do batch repo migrations via the cli. I can’t find it anymore though.
- Comment on a VPN that is easily self-hostable and resistant to blocking? 1 week ago:
It’s not quite a VPN, but it is very resistant against blocking:
- Comment on 1 week ago:
github.com/pgautoupgrade/docker-pgautoupgrade
Or if you are on k8s, you can use cloudnativepg.
- Comment on 1 week ago:
wiki.hackerspaces.org/List_of_Hacker_Spaces
Also check out meetup.com for linux user groups and other events.
- Comment on Remote KVM recommendations 1 week ago:
Also check out meshcentral. Important thing aboout meshcentral is that it lets you hijack the users screen, show you can show them step by step through things. RDP doesn’t do that, it kicks the other user out.
- Comment on Finally, an optimal monitor configuration! 1 week ago:
- Comment on An actually functional webproxy to self-host 1 week ago:
By the way: en.wikipedia.org/wiki/Shadow_IT
- Comment on An actually functional webproxy to self-host 1 week ago:
So, my high school used to have a domain/ip whitelist. The trick to get around whitelists is to take advandage of the fact that whole subdomains would be included in the whitelist, which would then also include any ip addresses.
Any duckdns subdomain, or anything hosted on many cloud providers would be unblocked.
So holy unblocker has a one click deploy, which can deploy to PaaS sites which would usually have their entire ip address space and subdomains included in the whitelist.
- Comment on Considering self hosting my own git repositories. What are some options? 1 week ago:
You should probably migrate now, forgejo is currently a soft fork that is fully compatible, but in the future they are planning to hard fork and not be compatible. Well, they are in the process of doing so right now.
- Comment on Xbox "Project Helix" confirmed to run Xbox and PC games - competition for the Steam Machine 1 week ago:
Xbox games are actually windows UWP apps, which is the format distributed by the Microsoft app store. Windows games from the MS app store are UWP as well. Xbox’s are actually Window’s PC’s, and have been this whole time.
But now, xbox is releasing a new device that is not locked down to shit and allows you to use some more of it’s full capabilities, and they act like it’s some hot new feature. I’m so fucking fed up of corporations forcing locked down shit on us and spoonfeeding us unlocked stuff and then expecting us to fucking worship the ground they walk, all because they deigned to “allow” us to use the devices the way they should have been usable from the very beginning.
- Comment on Search self-host user groups and acxess management 1 week ago:
Second post, but also check out midpoint by evoloum: docs.evolveum.com/iam/
It is a modern web frontend on top of Active Directory.
- Comment on Search self-host user groups and acxess management 1 week ago:
-
Use an Identity Provider (IDP)*. Other people have mentioned LDAP, which can play this role.
-
Use groups within the IDP to declare who has what privileges.
-
Apps using the IDP for auth can read the groups and allow/deny permissions based on groups.
*Or Identity and Access Management if you are in the cloud ig.
For open source solutions, I would recommend:
- Authentik (what I use)
- Kanidm (doesn’t have web ui)
- Nubus by Univention
These three solutions all have invites, ldap, and can act as oauth providers. (Oauth is single sign on), which are the features I want. There are also integrated, including it all in the one app.
There is also LLDAP, which is a web ui for ldap, and then you could use a service that connects to that, like authelia or keycloak, to add oauth on top.
-
- Comment on An actually functional webproxy to self-host 1 week ago:
No, Socks5 does not work for this usecase. You don’t get permissions to run it locally via crostini and the settings are locked in the chromebook settings. In addition to this, it is too easy to fingerprint, and some of the more aggressive setups will catch it and block it. For example, my high school would autodetect wireguard and then kick you off of the network for 10 minutes if you attempted to connect.
- Comment on An actually functional webproxy to self-host 1 week ago:
These kinds of setups are used to bypass agressive network filtering and content censhorship. All the traffic is http(s). And then the way only a browser is needed means it works on locked down devices like chromebooks.
The browser in docker is something I have used, but it requires more resources to host and can only be used by one person at once if you are using something like linuxserver’s webtop.
- Comment on An actually functional webproxy to self-host 1 week ago:
Yeah you want the titanium networks projects.
I used to use Metallic.
- Comment on Working to Decentralize FedCM 1 week ago:
This requires manually enabling every additional provider.
No, it doesn’t. The docs are confusing on this, but forgejo has two methods to enable oauth/oidc. One is to manually enable them, but there is a second, where people bring their own oauth link.
The docs contain 3 things related to oauth:
- Oauth provider forgejo acts as oauth for someone else
- Ouath client — This is the one where you manually enable providers
- But then there is a third config. Openid. This lets users bring their own openid/oauth link and sign in with that. No manual configuration required on the side of the forgejo server per client.
- Comment on Working to Decentralize FedCM 1 week ago:
Forgejo has a feature (that people usually disable) where you can bring your own openid connect url and use it to auth. So if I have my own OIDC provider I am self hosting, I can just use that to log in.
Most people only use it for google and microsoft and whatnot but it’s very possible. I don’t realkly see what FedCM offers that OIDC doesn’t or can’t, or why we shouldn’t be adding features to the existing and popular OIDC instead.
- Comment on GitHub - sergi0g/cup: 🥤Docker container updates made easy 2 weeks ago:
I use fluxcd with helmrelease’s which auto update the helm release. If the helm chart versions specify container versions, then updating the helm chart updates the containers in the deployments.
But for raw deployments, I found this, but not much else.
- Comment on Keycloak or alternative? 2 weeks ago:
In addition to adding more worker instances, you can also increase the amount of threads each worker instance uses to vertically scale. It’s about equivalent to adding a worker instance.
- Comment on Keycloak or alternative? 2 weeks ago:
Authentik is definitely the best of all I’ve tried. It has the most features, supporting both ldap and oauth, and also has an official helm chart.
- Comment on How to access home network (eg, VPN) without port forwarding? 2 weeks ago:
Tailscale already does though, I think.
tailscale.com/docs/features/tailscale-funnel
Although it might work differently.
- Comment on Adding "Log In With Mastodon" to Auth0 - Terence Eden’s Blog 3 weeks ago:
This reminds me of the way that forgejo lets you feed it an arbitrary openid url, sp you can log in with any service you want, including your own server.
- Comment on Twitch: "Hey, come back! This commercial break can't play while you're away." 3 weeks ago:
Owncast is the self hosted stream thing. It has some rudimentary federation capibilities, but nowhere near the ease discovery of twitch.
I know some streamers that have an owncast, expired_popsicle uses debian Linux and has one. (It’s tech/linux streamers because of course).
- Comment on It's me again. My Kubernetes devolver has reached the astral plane. 3 weeks ago:
go runworks by compiling the program to a temporary executable and then executing that.can you guarantee that runs everywhere
It seems to depend on glibc versions, if that’s what you are asking. You can force it to be more static by using a static musl python or via other tools. Of course, a binary for Linux only runs on Linux and the same for Windows and Mac. But yeah.
Also it should be noted that go binaries that use C library dependencies are not truly standalone, often depending on glibc in similar ways. Of course, same as pyinstaller, you can use musl to make it more static.