fonix232

To be perfectly fair, we've come a long, long way from 20-30 years ago when most firewalls were static or at best heuristic.

Today you can integrate solutions like CrowdSec into your reverse proxy setup (which, let's be fair, most people hosting things will be using to some extent), and transparently scans all requests for known exploit fingerprints.

Basically, if you've done the bare minimum of opsec, most likely your setup will be safe from being compromised, even if you're running an exploitable version of the problem software/stack.

And that's just a free and open source solution to securing your hosting - you can further deploy DPI based IDPs, analytics that spots irregular traffic patterns, especially in commercial environments, to protect against such attacks. It's not a guarantee, but such layered security at the very least adds some deterrence.

Random website: your password must include lower and upper case characters, numbers, special characters, emojis, invisible UTF-16 characters, be at least 32 digits long, contain no repeating sequences, mathematical sequences, musical sequences, a random episode number of Friends, parts of your username, email, mother's name, father's name, address, social security number, childhood address street name, first pet's name, any date between 32 March 1928 and 1 Feb 2077, or the special character ë̷̡̡̨̡̬̜̲̫̼̠̙̱̝̖̝̞͕͉͎̿́̂͗͂̉͐͑͐̀͗̔̊̈́̅̑͘͠ͅ.

CA private key security: "Pick a number between 0 and 10443888814131525066917527107166243825799642490473837803842334832839539079715574568488268119349975583408901067144392628379875734381857936072632360
8785136527794595697654370999834036159013438371831442807001185594622637631883939771274567233468434458661749680790870580370407128404874011860911446797778359802900668693897688178778594690563019026094059957945343282346930302669644305902501597239986771421554169383555988529148631823791443449673408781187263949647510018904134900841706167509366833385055103297208826955076998361636941193301521379682583718809183365675122131849284636812555022599830041234478486259567449219461702380650591324561082573183538008760862210283427019769820231316901767800667519548507992163641937028537512478401490715913545998279051339961155179427110683113409058427288427979155484978295432353451706522326906139490598769300212296339568778287894844061600741294567491
9823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335"

User: guess 4 will do

What the fuck are you on about?

1. Docker doesn't require podman at all
2. Learning the basics of Docker isn't that complex. Certainly isn't as complex as learning how to run VMs on a dedicated headless server.
3. If you look up "install docker", the first hit is, 9 out of 10 times, Docker Engine. NOT the desktop app...
4. No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass, network gear management was ass, and you didn't have forums and Reddit and Wikipedia and websites hosting manuals, tech blogs and guides and so on.... Then setting up Jellyfin, which is a fraction of the complexity of your job 30 years ago, should be straightforward. I am arguing that if you were capable of configuring complex services and devices 30 years ago, then today, with a million times more information readily available at your fingertips, you should be able to set up a simple service.

First it's a VM because I'm not going mess around with stuff on bare metal.

Containerisation method doesn't matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

The entire point is to be able to say "here's your config folder where you can write shit, but not execute; here's the data folder where you can neither write or execute shit; and here's the read-only executable layer of the image/VM/container".

Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

Regardless how you're hosting it, a reverse proxy is necessary. Even with a VM.

Here's a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

Then there's setting up the certificate with the dns provider.

Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me".

So the problem wasn't Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP...

Beside, that wasn't even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.

Port setup and it's perceived impossibility by you has naught to do with that topic.

It's literally just:

• create docker container
• forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
• forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS

I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.

Not if your Jellyfin is set up correctly.

Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.

Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

Hopefully with a firewall

And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.

I have tablets in my home, with batteries (as fallback in case of power loss - my HA instance and router/APs are on UPS).

I'm using older (thus cheaper) Samsung tablets. Fully Kiosk works well, but recently I've started adding kiosk features to the HA Android app (no public PRs yet so it's a few months away) to add some features (mostly sleep/wake via audio/camera motion, sleep screens, default pages for the specific instances etc.), so I can ditch FK.

Battery bloat is an issue - my Tab S6 is on its third battery (though admittedly it is nearly 7 years old now, got it January 2020), and my Tab S5e lasted 3.5 years until its battery started getting spicy. I've switched both to LineageOS to reduce heating + have more control over charging/discharging, and that so far seems to have helped. Unfortunately Samsung tablets don't support running off of USB without a battery (they bootloop if no cell is detected), so pulling the battery and running them off a wall outlet isn't really an option.

To me, a Pi or similar SBC with a touchscreen just seemed like a very hacky solution. I rent so I can't add a box in the wall for the board and PSU, and tablets are just more elegant. Throw in a 3D printed enclosure/mount, and you're golden.

I use mine regularly, especially since they wake whenever I walk past them.

Nice.

It is a shame that Volante Design closed down right when I got to a point in my life that I could spend a few thou on specialty clothing... They had some amazing Trek inspired stuff. The Disco uniform based denim jackets looked awesome.

Which would be perfectly acceptable if they didn't market features that are half-working, half-assed, and will be delivered over 1-2 years of the product's lifetime.

It's a bit like ST:Generations - every key component won't be delivered until Tuesday.

While I see why Sisko had to make that choice, political pressure notwithstanding, I disagree with it.

In any case of deciding the guardianship of a child, the first and foremost factor is the child's benefit - aka where and with whom does the child have the best chance of upbringing, including how the child feels where they should be.

In this case, Rugal wanted to stay with his foster parents. His benefit would've been to stay with them, and Sisko should've seen this. While yes, Rugal's father was indeed screwed over by Dukat's aide, his claim to guardianship was questionable at best. Would he provide for the boy to the best of his abilities? Sure. Would the boy have a happy, fulfilling life? Given his upbringing, no.

Unfortunately, politics played into it, and the Federation needed to score a gold star or two with the Cardassian government, and as such, the boy was handed over.

Wish I could do that. My brain also deserves the same study, because I constantly make (made) the worst possible investment decisions. Main difference is, I never failed upwards. if I did, I would be the owner of an incredibly successful investment firm.

Thank you for formalising what I've been thinking of Prusa in the past ~4-5 years.

Pretty much since Bambu blew up, they've been... hard to recommend. Even prior to that there were issues, but at the time they were the best option, even if expensive.

Bambu, Creality, Elegoo, Anycubic and the other Chinese brands have shown that you CAN deliver working new technologies without charging an arm and a leg for them.

Meanwhile Prusa manages two things really well: coming up with new ideas, and marketing them. Everything else seems secondary, and the whole pricing is just iffy for me - how are you going to deliver a product that costs 1.5-2x as much as competitors, promises the same features, but doesn't deliver on it?

Honestly, all the magic of Prusa went out the window the moment they decided to not be FOSS/OSH anymore.

Bambu is a double edged sword.

On one hand, their printers are really plug and play. Or, their most recent printers are plug, plug and play (talking about the "security key" they added to the X2/H2 series because of laser). You plug it in, and it works. And it works well. Fast, indeed Apple-style handholding, and generally very few issues when it comes to the higher end models.

The downside is, they're a Chinese company, with the usual Chinese business mindset: anything they take from others is fair game (copyright be damned), anything they do must be super secretive (to the point of breaking A/GPL licensing). They're also not too keen on admitting mistakes.

If you're in the EU or Europe in general, consumer protection laws will protect you from their shittery, most of the time. Otherwise you're SOL.

There's also the moral side of things. Bambu did rip off multiple companies, and recently lost lawsuits against Stratasys (honestly, this lawsuit was 💩 against 💩). They also went after open source devs with fraudulent DMCA takedown requests and C&D's, and have been pretty much Apple level anti-consumer-freedom.

But then again their printers are probably the most beginner-friendly, and the cheapest when it comes to multi-material handling. I mean the H2C, a 330x320x300 volume printer with 7 toolheads is £1900, whereas the closest to this (without AMS, without smart track switching for filaments, etc.) from other manufacturers will set you back 50-70% more (Prusa XL+ with 5 toolheads and no enclosure is £3600, for comparison).

But that's about it, if you want to go off the beaten path, do funky things and hope for open source integration... That won't happen with Bambu that easily. I've made my own changes to e.g. Bambuddy and OrcaSlicer to host the entire print stack "in the cloud" (on my own homelab I have remote access to, so I don't need a computer for full slicer support), but it's a hacky solution that's prone to break any time. Their entire stack is closed source (Bambu Srudio is FOSS because the base, Prusa Slicer and Slic3r, are GPL licensed, but their network plugin that allows direct comms to the printer, isn't), and you're at their mercy for firmware updates, features, bugfixes and whatnot. The X1 series had some custom firmware progress but it's mostly stalled nowadays.

My other main issue with going non-Bambu is that there aren't other companies really that are better AND aren't overpriced AF. Prusa constantly prices their machines 30-50% higher than their real market value, aiming at semi-professionals/businesses instead of consumers (plus they've been going non-FOSS for a while now). Creality, Elegoo, and all the other Chinese brands will have the same issues as Bambu - often even worse because they don't have the capacity for fully custom software thus end up violating GPL even more - so if your main qualm with Bambu is their non-openness, these are out the window too.

Anycubic might be the best choice, but they had their fair share of hardware troubles too - on the other hand, installing open software on their hardware is generally quite straightforward (at least compared to other brands).

And beyond these, you only have the big industrial players that focus on B2B sales and products... which isn't the best choice for home printers.

Ultimately you have the fully open printer options, like Voron. They aren't ready-made, at best you get all the parts in a kit and have to assemble it yourself, at worst you need to buy the individual parts yourself and have the printed parts printed by someone else. Much more work, but you're getting the most flexible printer out of it. If you check some of the hardcore 3D printing demos on Instagram/TikTok, you'll find that most use a Voron base with some heavy modifications to achieve some super funky results. I've seen some of these plastic-punks print things in 6-10 minutes that would take 2-3 hours on a Bambu printer! Plus if you want exotic material support (PEEK for example), you'd need a custom build anyway as Bambu's hotends/chambers only go to a certain temperature.

TBF I was going all out 😂but yeah the fact that my build essentially tripled in price is insane.

I built my PC in 2024. Okay specs - 7950X3D, 2x 48GB DDR5-6400, 4090, 1+4TB Samsung 990, all watercooled. About £4k total.

Today I could sell that PC for about 10-12k. RAM was originally £300, now it's £1800 IF you can buy it. The storage also cost me around £400, today, easily £1500.

No, I don't think that blower fan will be a good replacement for an Mk3s+.

See, one is a 3D printer, and the other is a fan.

Re: no glue

Indeed don't use glue sticks - or if you must, PREHEAT the bed before applying the glue, the heat helps form an even layer you won't really get with regular glue sticks.

I know it's expensive but I've had extremely good results with 3DLAC's bed spray. It applies evenly, doesn't stink like hairspray, isn't as gunky and sticky to get rid of, and even the worst offenders against bed adhesion have printed like magic after a single coat.

Of course none of this alleviates washing the damn thing with basic dish soap. I do spray mine afterwards with some isopropyl alcohol, but that's mostly to speed up the drying, not to clean it.

Not really though, given there's tons of cheap MCUs with the same or even more GPIOs available, and a USB/Wifi/Bluetooth connection away from doing the exact same thing as a Pi does. Could even whip up a linuxgpio driver that talks to your ESP32 fw and makes the same devfs gpiochipN endpoint available...

Well your mistake was going for 1GB.

That's barely enough for a basic headless server nowadays, let alone a full media suite.

There's a few RISC-V SBCs in Pi form factor already.

20 or so years ago, AAA titles were indeed big budget, but most of the game decisions were up to the developers and artists working on it.

Today, developers at studios are being forced to implement crap mechanics, change the gameplay, the story, the details, all to “make the game more viable for a large audience” in hopes of larger and larger ROI.

Does your compose file in itself give you a nice, easily readable status display, analytics, metrics, logging, etc. interface?

If you want a NAS specific case, check on AliExpress - a bunch of $200-300 options with SATA backplanes, EATX support, and your typical 8-16 front-loaded disk bay with disk caddies.

I think this topic is actually ripe for debate.

On one hand we know that Majel specifically recorded phonemes so her voice can be used for Star Trek purposes after her passing. While not a direct consent of "do whatever you want with my voice", the intent of similar purposes as OP's has been clearly present.

There's also Paramount's refusal to use her voice in new Trek, aside from a few snippets here and there (mostly Picard for the throwback value). Which kinda goes against the spirit of Trek.

On the other hand, the entire area of voice cloning is gray as fuck. It can very easily be used for nefarious purposes, yes - let that be corporate greed or fraud or propaganda. But if I make my own voice system, do I really hurt anyone by using their voice? I am not profiting off of it, I am not sharing the end result, it lives on my computer and that's it.

But, let's say I want to do the same. There's this TV show from some 20 years ago called Eureka. In it is one of the earliest representations of a smart house with an AI governor, called SARAH. SARAH is voiced by one of the recurring cast members, in fact it's an ongoing joke that the house is voiced by this guy "talking like a girl", and that he's trying to get Sarah Michelle Gellar to do the proper, final voice...

Now, the voice itself is pretty unique, but it isn't the voice of the actor, it's been heavily digitally edited. It's also a pretty unique voice but not something 99.9% of people would recognise. I make my clone from my own BR disk collection, with a set of automated and AI tools to get the right audio, clean it up, split by talker, and process all 77 episodes, manually selecting the right samples, manually tagging and labelling each; and finally, fine-tuning my own model for my own use. It will never leave my home, I won't sell or share it, and technically, with me owning the BR collection, this would fall under fair use.

Which is still quite different than, say, a corporate entity trying to sell more product by using your voice.

To be perfectly fair, a proper wheel of Parmigianino Reggiano IS quite hard...