hirihit640

Declarative configuration (like docker compose) is basically “code local, push remote”, and it has a lot of benefits, including improving efficiency because you have a clearer idea of exactly what is set up on the server, to make it easier to debug or make changes.

Contrast this with just sshing in and running a bunch of commands to install something. Then coming back months later and wondering “what files did I touch? what packagea did I install? Hmm dpkg log says I added X but then later I removed it, so was it important?” Etc.

Just look up firmware rootkits and UEFI rootkits. For example: arstechnica.com/…/researchers-unpack-unkillable-u…

Security is a big reason to use VMs. Containers share the kernel with the host. That means that any of the kernel vulnerabilities from this year (like DirtyFrag and CopyFail) could have been used to compromise your host. Once the host is compromised, the only way to be safe is to literally buy a new machine. Seriously. Viruses can bury deep and even infect the motherboard firmware to persist indefinitely.

Kernel vulnerabilities are frequent enough that I find VMs worth it. I still use containers in my VMs though.

Why not put your wiki notes on your admin machine (whatever machine you use to manage the proxmox server)?

If you wrote an article I’d read it! But this is a great starting point nonetheless, thanks

Which local AI did you use?

For those that like the cli, you can use flatpak remote-info --log flathub com.stremio.Stremio to scroll through the list of past versions, and look for the “Commit” id of the version you want, then do:

flatpak update --commit=<commit id> com.stremio.Stremio

Then use flatpak mask to prevent further updates.

A lot of times its tech opinion articles. Stuff like “why AI is bad”. And I read the arguments and judge them for myself.

I already considered that, and for an untrusted website I already don’t trust the content or the scripts. So it doesn’t matter if it was modified or not, it’s still untrusted.

Facts can be verified with sources you do trust (which should be using HTTPS). Logic can be used to verify others.

IMO when reading random articles on the internet you already have to worry about untrusted scripts. I just use NoScript, and if the website requires Javascript I move on

If you’re just pushing for WebPKI without “thinking too hard” about perpretrating a system of centralized trust on government-controlled entitites, then you’re following that windows method.

SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web. So I don’t see the problem with this website doing their own thing to bring attention to the potential issues of the current system.

It works fine, just ignore the warning and don’t enter any sensitive info

This is a cool idea, and I love the hacker energy behind it, but I agree with some of the other comments that the receiver would have to trust you quite a bit to allow hardware into their house. Even with the SSH view-only accounr, you could be putting the SSH server in a VM so that the client thinks they’re seeing the whole OS but they aren’t.

Alternative idea would be to provide an open source ansible script or docker compose file to spin up everything you need, and let them verify and deploy it themselves. Then they give you the wireguard configs to remote in.

I’m running into similar issues, do you mind expanding on your solutions?

Ok that makes sense. As a user I’ve always wondered what it was like from the providers perspective. I always hear people complaining that more and more websites block VPNs, but sounds like it might be better to say more and more websites block scrapers and the VPNs are collateral. Thanks for the insight

Do you know if the scrapers/bots are using the VPN providers? Or if they are just using VPSes in the same datacenter as the VPN, and the datacenter is just NATing all egress traffic to have the same IPv4. In that case I wonder if IPv6 could help distinguish between VPN traffic and bot traffic…

Though ultimately a gate like Anubis or Angie Guardian might be the best solution here so nice work.

Unfortunate but understandable. I believe there are public lists of the IPs of major VPN providers if you wanted to make an exception, but as VPNs are sometimes used for scraping too, I can see why you might not want that.

I do. Do you block all VPNs? Or is it just rate limiting?

Actually now that I check your username I think I have seen your instances before, though it seems like your website is down at the moment. But thank you for service to open source !

how are you using 128 GB? Genuinely curious because I run over 20 services with only 8 GB

No unfortunately it does not. Sometimes the webpage itself contains a meta tag with the original URL but not always

I have tons of webpages saved using the Firefox built-in page saver, which saves and html file and a corresponding folder for the other resources (images, javascript). Would be cool if these could be imported as well. Though maybe the resource folder can be ignored and the html file can already be imported?

you don’t need GIMP just to convert and resize images. Not sure what platform OP is on but there are plenty of batch image resizers and converters for any platform

Well I’m not trying to start a community around helping people, I’m just a participator. If I wantsd to maximize the number of people I could help, I might move back to reddit

Those saying “just self-host Matrix/Stoat/XMPP”, do not understand the power of network effects. If people are too lazy to sign up on your custom server, and you end up with 50% of the users you would have gotten if you used Discord, is that worth it? What if it was only 10%?

I wish there were a solution to this. Interoperability sounds nice until you have multiple competing standards (like Matrix and XMPP)

Depending on the number of devices you have, your threat model, it can be helpful to set up a security hierarchy. So you only need to worry about securing the devices at the top of the hierarchy, and can play loose and careless with the devices lower down. That way it’s less likely to lose everything due to one mistake

Even if you have a password for your ssh key, malware on your system can just wait until you enter the password.

My point is that SSH access is very powerful, and effectively means that the security of the SSH server is reduced to the security of the SSH client. If your SSH client is pwned, so is your server. If you have 10 devices each with ssh access to each other, then if any one device is pwned, all devices are pwned as well.

This is not the case for systems designed for file sharing only. For example with syncthing, if one device gets pwned, all it can do is send files to the other devices.

Most people probably don’t care but it can be a security risk, allowing malware to move “laterally” between all your devices. For my main devices I don’t give them SSH access to each other, but I do give them SSH access to my secondary devices (like a Pi-Hole)