NaibofTabr
@NaibofTabr@infosec.pub
- Comment on How do we quit YouTube? 2 days ago:
There are other video sharing sites, like Odysee or BitChute or of course PeerTube, but there is no alternative to the 30 years of content that is YouTube.
- Comment on Any tips on plastic adhesives? Trying to repair headphones 3 days ago:
There is a JB Weld UV glue product that comes with a UV LED attached:
www.jbweld.com/product/superweld-light-activated
It’s a blend, not pure UV resin, that will harden quickly where the light hits it but will also slowly cure without UV exposure, so the inner parts of the joint will harden over time.
- Comment on Microsoft is overhauling the Windows 11 interface with WinUI everywhere 6 days ago:
- Comment on “Sir HMS Invincible has exploded.” 1 week ago:
- Comment on “Sir HMS Invincible has exploded.” 1 week ago:
HMS Target Practice
HMS Leaky Bucket
HMS Smoke on the Water
- Comment on Problem with receiver 1 week ago:
Yeah if you’re down to put the effort into fault tracing, you’ll need an oscope. Something like this: ebay.io/m/PDLGdu will work fine.
It will take some time, but if you’re lucky you’ll find it’s just a capacitor that you can replace cheaply. If you’re unlucky you might find that it’s a faulty IC, in which case you might have to replace an entire circuit board from a donor unit anyway.
- Comment on Problem with receiver 2 weeks ago:
You’re going to have a hard time pinning this down to a specific component without a circuit diagram. I did find that there’s a service manual for this unit: elektrotanya.com/…/download.html
Seems to be legitimate and has diagrams.
I would recommend starting on the output side - is the popping present on every speaker output? Both left and right? Use a very simple speaker for this, one that doesn’t require its own power source, just a red and black wire. Also, is the popping present with no input audio?
If you can narrow it to a certain output you can backtrack it to a specific section of the circuit that feeds that output. Alternatively, if it’s present on all outputs then it must be a component that is common to all, and therefore behind the area that splits to the different outputs.
An oscilloscope would be handy - you could identify the faulty signal at the speaker output, then check points along the path backward. Half-splitting is your friend. You don’t have to buy an expensive piece of lab equipment, a cheap $30-40 digital oscope will be good enough.
Another option would be to throw parts at it. I see units listed for parts on eBay for ~$80. You could try swapping out circuit boards one at a time.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
Copying GNU GPL code without licensing your derivative code as GNU GPL and publishing it where it’s publicly accessible, and then using your derivative code to generate profit for a corporation, is definitely theft. Just because it’s open source doesn’t mean you can just do whatever you want with it, the original programmer still has rights over the code they wrote.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
That’s a stretch, since we don’t know exactly how human learning works.
It is not a stretch. We may not know exactly how human learning works, but we do know exactly how machine learning works, and we know that it is not like how human learning works. It is absolutely possible to differentiate things even without complete knowledge.
I don’t know about you, but I for one have not produced anything ‘original’ my entire coding career by that metric. I feel confident in saying the vast majority of programmers have not either.
This is a bad argument. The output of a generative model is a copy-and-paste function from a library of ingested code samples with a fairly competent keyword search attached to it. Code writing bots are just script kiddie crutches.
If all you did was copy and paste from GNU GPL code, then your output would also be bound by the same license.
But I disagree with the idea that their method of learning and their actions is inherently different from what the average person does.
Then you don’t understand even the basics of the mathematics that makes them actually work. It’s a purely algorithmic process. It’s an outgrowth of multidimensional analysis and optimization, that’s all.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
It is actually not like a person learning at all. The only way you could believe this is if you have no grasp of the mathematics that are the basis of the multi-dimensional statistical analysis which is neural network training, and haven’t bothered to do any reading on it.
- Comment on Self Hosting- Security recommendations 3 weeks ago:
Your first concern should be your boundary firewall. You should have all ports closed except the ones that you are definitely using for external services. You should know which ports you have open and why, and what traffic, how much and how often you expect to see on those ports (8080 will have regular Internet use traffic, but your reverse proxy port should only have traffic when you’re away from home and actively using it), and you should monitor that traffic at the firewall every so often, and especially when you make changes to your network. Closed ports should be configured to drop packets rather than respond that the port is closed (stealth mode). On a home network, preventing unwanted incoming connections will protect you from the majority of malicious activity. It’s the most effective single thing you can focus on.
The next thing would be to separate untrusted devices onto dedicated VLANs. This would be for IoT devices, gaming consoles, “smart” appliances, anything that connects to the Internet whose software you don’t have control over. They get isolated on a VLAN that only connects to the Internet and doesn’t allow local connections to devices on other VLANs, so the rest of your network doesn’t exist as far as they’re concerned. This should cut down on things like “smart” appliances taking inventory of your home network and reporting it back to the manufacturer’s servers.
If you do these two things, and you’ve got your reverse proxy configured properly so that other people can’t break into it, you should minimize unwanted connections to your network and your server/containers should be fine with default internal firewall policies. The only reason you would need to do more is if you expect a direct/intentional attack by a motivated hacker, but in that case there’s not much you can do unless you’re an expert.
If you want to go further, try implementing the community version of runZero:
www.runzero.com/platform/community-edition/
help.runzero.com/docs/self-hosting/
www.cisa.gov/…/runzero-community-edition
This is a network visibility tool that will discover and identify devices. To get a really complete look, you would run it from inside your network and deal with anything that you don’t think should be accessible, then run it again from outside your network to see what a potential attacker would see.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
Digital reproduction is digital reproduction no matter how many extra steps are added to the reproduction process. It’s just an algorithm that sorts through a collection of stored data to find specific pieces of data which best fit the keywords supplied by the user, then regurgitates the results that are the best match based on correlation.
In spite of common meaning overlap and popular metaphors, the human brain is not a computer. Ask any neurologist.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
This is a misunderstanding based on confusion between technical and colloquial terminology.
A machine learning model “learns” information in the same way that a curve fitting algorithm “learns” the shape of a data set.
This is not the same as the colloquial meaning of human learning. It is a mathematical process.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
This comparison is invalid. Training a neural network algorithm is not equivalent to human learning. We are talking about data stored in machine learning models owned and controlled by multi-billion dollar corporations.
It has already been demonstrated multiple times that original training data can be reproduced completely from models, so yes, they are data storage systems. When they reproduce code which they have previously stored, even only in part, that is a derivative work. Adding extra steps to the transcribing process doesn’t make it any less a copy of the original.
- Comment on Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away." 3 weeks ago:
Every single generative tool is built on theft. No one has a training database that only contains code they were given legal permission to use for that purpose. Moreover, if these tools were trained on any GNU GPL code, then the tool and all of its output should also be GNU GPL:
if you distribute a derivative work or modification, you must provide the source code to those recipients under the same or equivalent license terms
en.wikipedia.org/wiki/GNU_General_Public_License
None of the companies developing these tools are obeying the terms of the licenses. The trained models are the product of theft.
You cannot be a moral person and approve of the use of these tools, they are diametrically opposed.
- Comment on Imagine if those works survived 3 weeks ago:
I mean… We do have the Wayback Machine
You can see what the Internet was like in 1996:
- Comment on Roblox announce plans to let people AI generate basic games using text prompts stuck into a mobile app, but claim that won't fill their homepage with AI slop 4 weeks ago:
Ooh… so Roblox uses Luau internally for user-developed game logic, which means that you could probably get the AI to write you a complete application and execute it within the Roblox environment. This seems ripe for exploitation.
- Comment on [Support] HDD diing or something else? 4 weeks ago:
More specifics are needed for a support request. Provide the baseline specifications please.
What OS are you using? What is the make and model of the drive? Is it internal or external? USB? SATA? SAS? NVMe? A PCIe adapter? Is this a desktop, laptop, NAS, server, NUC, Raspberry Pi with an expansion board?
Are you familiar with SMART? Have you done any diagnostics?
- Comment on What actual damage do you secure your servers against? Whats the attack vector? 4 weeks ago:
Heh, I opened port 22 on my home network once. There wasn’t anything on it to connect to, but the firewall recorded thousands of SSH connection attempts within hours. Within a day it had over a million hits.
- Comment on What actual damage do you secure your servers against? Whats the attack vector? 5 weeks ago:
I wonder what you are securing against?
OK, you’re familiar with vulnerability scanners and port scanners right?
The threat model here isn’t really attackers specifically targeting your home network for any particular reason (unless you’re a LastPass engineer working remotely while running an exposed Plex server). They’re not looking for you, they’re looking for anything useful.
The threat model is attackers using scanning tools to discover vulnerable systems connected to the Internet. All they need from you is an active connection and a system that can store data, from which they can host malware files for distribution to other targets or conduct attacks or just run a cryptominer (if you’re lucky and they’re not very ambitious). They can find this by scanning for open ports and then running a vulernability scanner to figure out if there’s some exposed hardware that can be exploited.
An unsecured system is a hazard that could land you in jail when someone else starts using your device and network connection to commit crimes.
Now, as long as you’re behind a standard residential network service, and your ISP is in control of your gateway device, you’re relatively safe from this. Most ISPs will block any traffic like that very strictly. If your ISP is in control of your gateway device then they’re responsible for its behavior (demarcation matters).
But, most self-hosters run into limitations with their ISP blocking a lot of ports by default, because they want to access their personal server from outside their home, and so they take control by running their own gateway device or paying for a business connection which gives them complete control over which ports are open. This is where the risk comes in.
If you’re going to do this, you should know exactly which ports you have open to the outside and why, and a general idea of what traffic you expect to see on them when and how much. Monitor that traffic at your firewall. Every other port should be closed and your firewall (on your router, gateway device, or better yet a dedicated OPNSense firewall) should be configured to drop packets received by closed ports (“stealth” mode). You don’t want it to respond that those ports are blocked, you want it to appear to not be there at all.
Every other security implementation is a secondary concern for a home network. Yes you should patch your software regularly and you should practice deny-by-default and least-privilege as a matter of course, but you’re going to mitigate 90% of your risk by just not accepting incoming connections for anything you don’t need. Most vulnerable systems are discovered by automated scanning, so the less your system responds to external connections the better. If you’re going to worry about configuring, securing and patching one device, make it that front line firewall. And be very selective about which internally hosted services you expose externally.
- Comment on Vaultwarden while allowing family emergency access 1 month ago:
You are running into the ultimate, and ultimately unavoidable, limitation of self-hosting, which is the self.
You should run a VM on the VPS for Vaultwarden, with no other services in the VM except whatever you need to connect to it remotely. Keep it simple. Run a copy of the VM on your local server. Have the VPS instance push backups to the local instance. When you need to update the software, freeze an image of the local VM and then update the local VM, then when you’re sure it’s stable, copy the updated local VM to the VPS. If either the local or VPS instance crashes out, you should be able to recover (or reproduce) one from the other.
In the end though, it is functionally impossible to ensure reliability by yourself. Hosting Vaultwarden on a VPS shifts the responsibility for running the underlying server and network connection to the provider, and probably removing the dependence on your residential network connection will be better for your family/users.
You are still the weak point in your system. You need someone else who can log in to your local server, and into the VPS, and perform recovery if needed. There is no technical solution for this. You cannot be the sole admin, and also ensure reliability for other users.
- Comment on How it goes everytime 1 month ago:
I thought we were an autonomous collective.
- Comment on How the mighty have fallen 😭 1 month ago:
Yes, well, constant naval warfare became unfashionable, you know.
- Comment on What's the point of secret areas if they're going to be boring? 1 month ago:
It was just a place where the priests could go so people wouldn’t bother them for awhile.
- Comment on Me too 1 month ago:
Can’t lose a thing you never had.
- Comment on What's your contingency plan for the apocalypse? 2 months ago:
- Comment on Revisiting Rule #3 Hey everyone, as I previously mentioned the rules here are 2 months ago:
- Comment on Any ideas why the top roof warped like it did? 2 months ago:
OK, interesting, no draft. Is it PLA? Is the chamber being actively heated? What is the printer model?
- Comment on Any ideas why the top roof warped like it did? 2 months ago:
The supports are only lightly connected to the object, to make them easier to remove. The force being exerted by the plastic as it cools is stronger than the light connection to the supports, especially over such a large area.
Probably there is a draft causing it to cool to rapidly. An enclosure, even just a cardboard box around the print area, would help.
- Comment on Drilling and tapping LiFePO4 battery terminal practicality? 3 months ago:
OK, I’m no expert but it says this at the end of that product listing:
Secure this matched 2-pack of premium Sunwoda 314Ah cells—fresh stock from a respected brand, with flat studs for easy welding/integration.
Are you saying they need a heavier gauge bus bar for the current, something too thick for a small spot welder? Would you MIG/TIG weld a battery contact?