hirihit640

For those that like the cli, you can use flatpak remote-info --log flathub com.stremio.Stremio to scroll through the list of past versions, and look for the “Commit” id of the version you want, then do:

flatpak update --commit=<commit id> com.stremio.Stremio

Then use flatpak mask to prevent further updates.

A lot of times its tech opinion articles. Stuff like “why AI is bad”. And I read the arguments and judge them for myself.

I already considered that, and for an untrusted website I already don’t trust the content or the scripts. So it doesn’t matter if it was modified or not, it’s still untrusted.

Facts can be verified with sources you do trust (which should be using HTTPS). Logic can be used to verify others.

IMO when reading random articles on the internet you already have to worry about untrusted scripts. I just use NoScript, and if the website requires Javascript I move on

If you’re just pushing for WebPKI without “thinking too hard” about perpretrating a system of centralized trust on government-controlled entitites, then you’re following that windows method.

SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web. So I don’t see the problem with this website doing their own thing to bring attention to the potential issues of the current system.

It works fine, just ignore the warning and don’t enter any sensitive info

This is a cool idea, and I love the hacker energy behind it, but I agree with some of the other comments that the receiver would have to trust you quite a bit to allow hardware into their house. Even with the SSH view-only accounr, you could be putting the SSH server in a VM so that the client thinks they’re seeing the whole OS but they aren’t.

Alternative idea would be to provide an open source ansible script or docker compose file to spin up everything you need, and let them verify and deploy it themselves. Then they give you the wireguard configs to remote in.

I’m running into similar issues, do you mind expanding on your solutions?

Ok that makes sense. As a user I’ve always wondered what it was like from the providers perspective. I always hear people complaining that more and more websites block VPNs, but sounds like it might be better to say more and more websites block scrapers and the VPNs are collateral. Thanks for the insight

Do you know if the scrapers/bots are using the VPN providers? Or if they are just using VPSes in the same datacenter as the VPN, and the datacenter is just NATing all egress traffic to have the same IPv4. In that case I wonder if IPv6 could help distinguish between VPN traffic and bot traffic…

Though ultimately a gate like Anubis or Angie Guardian might be the best solution here so nice work.

Unfortunate but understandable. I believe there are public lists of the IPs of major VPN providers if you wanted to make an exception, but as VPNs are sometimes used for scraping too, I can see why you might not want that.

I do. Do you block all VPNs? Or is it just rate limiting?

Actually now that I check your username I think I have seen your instances before, though it seems like your website is down at the moment. But thank you for service to open source !

how are you using 128 GB? Genuinely curious because I run over 20 services with only 8 GB

No unfortunately it does not. Sometimes the webpage itself contains a meta tag with the original URL but not always

I have tons of webpages saved using the Firefox built-in page saver, which saves and html file and a corresponding folder for the other resources (images, javascript). Would be cool if these could be imported as well. Though maybe the resource folder can be ignored and the html file can already be imported?

you don’t need GIMP just to convert and resize images. Not sure what platform OP is on but there are plenty of batch image resizers and converters for any platform

Well I’m not trying to start a community around helping people, I’m just a participator. If I wantsd to maximize the number of people I could help, I might move back to reddit

Those saying “just self-host Matrix/Stoat/XMPP”, do not understand the power of network effects. If people are too lazy to sign up on your custom server, and you end up with 50% of the users you would have gotten if you used Discord, is that worth it? What if it was only 10%?

I wish there were a solution to this. Interoperability sounds nice until you have multiple competing standards (like Matrix and XMPP)

Got it. Access to docker.sock is definitely something to be wary of, or CAP_ADMIN, or access to certain host devices.

Worth mentioning though that Jellyfin usually has none of these.

With that setup, an attacker could mount the host filesystem to the container and would own the host from that container.

Can you elaborate more on this? Assuming an attacker is in the Jellyfin container with full remote code execution, how could they mount the host filesystem?

Can you put the auth OIDC in the DMZ VM, forwarding to caddy in the other VM with all the services?

If you can’t, you can always use firewalls on the services VM to prevent services from talking to each other. Preventing them from talking to the internet can be achieved by putting them in an “internal” network (if using docker compose, set “internal: true” when defining the network)

I’m not sure I understand. First off I’m not the same person as GP. Second, the admins are proposing an AI tag, which I’m supportive of. I’m just saying that I am OK with AI-assisted projects being posted to this community (with the AI tag of course)

Fine, but others including myself want that slop as far away from here as possible

And there are people like me who are fine with moderate AI use and would rather judge the project themselves rather than have them rejected outright.

Depending on the number of devices you have, your threat model, it can be helpful to set up a security hierarchy. So you only need to worry about securing the devices at the top of the hierarchy, and can play loose and careless with the devices lower down. That way it’s less likely to lose everything due to one mistake

Even if you have a password for your ssh key, malware on your system can just wait until you enter the password.

My point is that SSH access is very powerful, and effectively means that the security of the SSH server is reduced to the security of the SSH client. If your SSH client is pwned, so is your server. If you have 10 devices each with ssh access to each other, then if any one device is pwned, all devices are pwned as well.

This is not the case for systems designed for file sharing only. For example with syncthing, if one device gets pwned, all it can do is send files to the other devices.

Most people probably don’t care but it can be a security risk, allowing malware to move “laterally” between all your devices. For my main devices I don’t give them SSH access to each other, but I do give them SSH access to my secondary devices (like a Pi-Hole)