Hiker, software engineer (primarily C++, Java, and Python), Minecraft modder, hunter (of the Hunt Showdown variety), biker, adoptive Akronite, and general doer of assorted things.

  • 0 Posts
  • 188 Comments
Joined 1 year ago
cake
Cake day: August 10th, 2023

help-circle





  • I recommend against hosting a password manager yourself.

    The main reason is self hosted systems require maintenance to patch vulnerabilities. While it’s true that you won’t be on the main list if e.g. bitwarden gets hacked, your data could still be obtained or ransomed by a scripted attack looking for e.g. vulnerable VaultWarden servers (or even just vulnerable servers in general).

    Using professional hosting means just that, professional hosting with people who’s full time job is running those systems and keeping people that aren’t supposed to be there out.

    Plus, you always have the encryption of the binary blob itself to fall back on (which if you’ve got a good password is a serious barrier to entry that buys you a lot of time). Additionally vaults are encrypted with symmetric crypto which is not vulnerable to quantum computing, so even in that case your data is reasonably safe… And mixed in with a lot of other data that’s likely higher priority to target.



  • even when we hand them the power to make change.

    Here’s the problem, WE DIDN’T.

    You don’t have power to make change unless you have a super majority or you can caucus with people across the aisle. If I put YOU in the Senate right now instead of Sherrod Brown it won’t help. It might help if I put you in instead of J.D. Vance, but only if we don’t lose Sherrod Brown.

    This isn’t just some “you work really hard at it and you can get anything done” situation. You need the votes, Democrats as a party agree on what the vote should be, but there are not enough representatives from the Democratic party that agree with the party platform to take the vote.

    It’s not some conspiracy, it’s just how it works. It sucks, but the only way to fix it is to get more people to vote and just keep voting. Vote in primaries for people you think can win. Vote for ranked choice initiatives that might allow us to get away from two party voting. Vote for Democrats that agree the filibuster should be done away with.

    Do not just go around making up stories about how the Democrats have super powers they don’t have though. It’s simply false information that ultimately hurts Democrats.







  • Can’t comment on the DOCSIS, I don’t know enough about it to not be making stuff up.

    Regarding WiFi though… The simple answer is if you’re not having trouble accessing the WiFi in the places you use the WiFi and you’re getting the full speed that you’re paying for, there’s not a ton of a reason to upgrade the router.

    The exception to this is that most routers only get a few years of security updates like most phones… That can potentially leave your network more vulnerable as the router might not properly block unsolicited traffic from making it to your devices. There’s a solid argument that you should just have your devices secured via their own firewalls though.

    The Google routers are nice for the average Joe because they just kind of work and keep themselves updated (and Google tends to keep the hardware they sell under the Nest name receiving security updates a VERY long time compared to the competition). Netgear has been my go to for years but their update mechanism is … fairly manual in my experience.

    I’ve since moved to having a pfSense box for the firewall and routing side of things and using my old negate router in access point mode (I’m much less concerned about this setup).

    I’ll add that I don’t recommend WiFi for gaming… And that most people have more download speed than they really “need.” Files really haven’t gone up in size much (sure games have) but evening else… meh (?). Video streaming is more popular but unless you’ve got a lot of people in your home or you stream at 4k, it’s really not going to be that noticable between 30Mbps and 1Gbps. So like, by all means if you don’t want to spend money, don’t… you’re probably fine.



  • Honestly a huge portion of the problem is asshole drivers that just don’t turn off their brights and their fog lights or that tailgate the vehicle right in front of them while their headlights are mirror level.

    I’ve seen brand new trucks with LEDs that were so easy on my eyes then I’ve seen the exact same model of truck via rearview mirror only after I passed it because the lights were beyond blinding.

    They need to enforce maximum luminosity laws with an iron first; it’s ridiculous that people get away with this stuff.




  • Dark Arc@social.packetloss.ggtoSelfhosted@lemmy.worldPaid SSL vs Letsencrypt
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    1
    ·
    2 months ago

    So, the web uses a system called chain of trust. There are public keys stored in your system or browser that are used to validate the public keys given to you by various web sites.

    Both letsencrypt and traditional SSL providers work because they have keys on your system in the appropriate place so as to deem them trustworthy.

    All that to say, you’re always trusting a certificate authority on some level unless you’re doing self signed certificates… And then nobody trusts you.

    The main advantage to a paid cert authority is a bit more flexibility and a fancier certificate for your website that also perhaps includes the business name.

    Realistically… There’s not much of a benefit for the average website or even small business.


  • So the local machine doesn’t really need the firewall; it definitely doesn’t hurt, but your router should be covering this via port forwarding (ipv4) or just straight up firewall rules (ipv6).

    You can basically go two routes to reasonable harden the system IMO. You can either just set up a user without administrative privileges and use something like a systemd system level service to start the server as that user and provide control over it from other users … OR … if you’re really paranoid, use a virtual machine and forward the port from the host machine into the VM.

    A lot of what you’re doing is … fine stuff to do, but it’s not really going to help much (e.g. building system packages with hardening flags is good, but it only helps if those packages are actually part of the attack surface or rather what’s exposed to the remote users in someway).

    Your biggest risk is going to be plugins that aren’t vetted doing bad things (and really only the VM or using the dedicated user account provides an insulation layer there – the VM really only adds protection against privilege escalation which is pretty hard to pull off on a patched system).

    My advice for most people:

    • Make a new user on the system to run each game you want to run
    • Run the game using systemd and that user
    • Use something like kopia + the root user’s crontab (easier than systemd timers, but systemd timers also work) to backup the files on disk

    For Minecraft in particular, to properly back things up on a busy server you need to disable auto save, manually force save, do the backup and then enable auto save again after your backup. Kopia can issue commands to talk to the server to do that, but you need a plugin that can react to those commands running on the server (or possibly to use the server console via stdin). Realistically though, that’s overkill and you’ll be just fine backing up the files exactly as they are periodically.

    Kopia in particular will do well here because of its deduplication of baked up data + chunking algorithm that breaks up files. That has saved me a crazy amount of storage vs other solutions I’ve tried. Kopia level compression isn’t needed because the Minecraft region files themselves are already highly compressed.