Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)C

Chewy

@ Chewy7324 @discuss.tchncs.de

Posts
13
Comments
99
Joined
3 yr. ago

  • What are the pros and cons of btrfs?

    Jump

  • Regular btrfs scrubs is a good idea to detect data loss/drive failure early. I have a monthly sytemd timer run it automatically.

    Btrfs balance can also free up space but I don't run it regularly.

  • Fedora change aims for 99% package reproducibility

    Jump

  • "given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts"

    NixOS does not guarantee bit-by-bit identical results. NixOS hashes the inputs and provides a reproducible build environment but this does not necessarily mean the artifacts are identical.

    E.g. if a build somehow includes a timestamp, each build will have a different checksum.

  • OpenID Connect Single Sign-On Identity & Access Management

    Jump

  • It's great to see another open source OIDC provider (with more features). I've set up Pocket ID which is awesome because of it's simplicity and it's great.

  • What steps do you take to secure your server and your selfhosted services?

    Jump

  • I found the guide/examples on their website a bit irritating at first (that's on me) but it works well once understood and configured.

  • What steps do you take to secure your server and your selfhosted services?

    Jump

  • Yes. 127.0.0.0 is the localhost. This is the IP the container is listening on. Even if there was no firewall it wouldn't allow any connection except from the host. If it's set to 0.0.0.0 it means it'll allow connections from any IP (which might not be an issue depending on your setup).

    The reverse proxy runs on localhost anyway, so any other IPs have no reason to ever have access.

  • What steps do you take to secure your server and your selfhosted services?

    Jump

  • It's mostly to allow the reverse proxy on localhost to connect to the container/service, while blocking all other hosts/IPs.

    This is especially important when using docker as it messes with iptables and can circumvent firewall like e.g. ufw.

    You're right that it doesn't increase security on case of a compromised container. It's just about outside connections.

  • What steps do you take to secure your server and your selfhosted services?

    Jump

  • Some I haven't yet found in this thread:

    • rootless podman
    • container port mapping to localhost (e.g. 127.0.0.1:8080:8080)
    • systemd services with many of its sandboxing features (PrivateTmp, ...)

  • What steps do you take to secure your server and your selfhosted services?

    Jump

  • I do the same, but with Wireguard instead of OpenVPN. The performance is much better in my experience and it sucks less battery life.

  • Making sure restic backups are right

    Jump

  • Trying to actually restore is the best way to ensure the backup works. But it's annoying so I never do it.

    I usually trust restic to do it's job. Validating that files are there and are readable can be done with restic mount, and you've mentioned restic check.

    The best way to ensure your data is safe is to do a second backup with another tool. And keep your keys safe and accessible. A remote backup has no use of the keys burned down.

  • Internet forums are disappearing because now everything is Reddit and Discord. And that's worrying.

    Jump

  • Yes. I like to leave the original link in the post body for that reason.

  • Internet forums are disappearing because now everything is Reddit and Discord. And that's worrying.

    Jump

  • Sadly it's not possible to provide links using Firefox Translate. People would have to translate it themselves (i.e. opening in a browser and clicking translate). Depending on the device they likely wouldn't bother.

  • Internet forums are disappearing because now everything is Reddit and Discord. And that's worrying.

    Jump

  • Agreed. In general people seem to like centralised platforms. They don't want to sign up on another site for a specific purpose. They stick to what they know unless there's good reason to change (mostly peer/ad/social media pressure I feel like).

    In a way Lemmy is similar in that it's a single platform to access all types of content. Given most people don't care about the technical "how", I can see why they like Discord and Reddit.

  • Plex is locking remote streaming behind a subscription in April

    Jump

  • I use Findroid for its great UI but also its ability to download and watch offline. It's a better experience and I was surprised Jellyfin Android didn't support it.

  • Plex is locking remote streaming behind a subscription in April

    Jump

  • I wonder how much money Plex still makes through their lifetime purchases. Is it that they were struggling and then made bad business decisions with the aim on increasing revenue (ad supported video on demand)? Or was it the other way around?

    In the 80s new systems usually came with new OSs, which required porting software it. Thus a lifetime license was practically limited.

    I wouldn't be as opposed to a subscription model if it was cheaper and they focused on their actual core product, not all the other fluff around. 5€/m is a bit much given they don't pay for my bandwidth. And if they didn't store my media info, history etc...

  • Enshitification of CrowdSec Edit: bug in CrowdSec limiting features

    Jump

  • To me there's a major difference depending on the cost of the provided service. I don't know what features crowdsec provides, but if it's mostly providing lists and all the blocking etc happens locally, I don't see how they lose much money on this free service. Gathering the lists is something they'd have to do anyway to service their paying customers.

    If Cloudflare stopped making Cloudflare Tunnels free to use, I'd be more understanding since bandwidth costs them relevant amounts of money.

  • NixOS containers vs. Docker containers

    Jump

  • NixOS container is using systemd-nspawn/systemd container. Both are using Linux namespaces and cgroups.

    A disadvantage of NixOS container is that it only supports rootful containers, i.e. root inside the container has the same privileges as root outside the container. This is also true for docker unless configured otherwise.

    OCI containers (Docker, Podman) are often created by upstream themselves, which you might prefer.

    I configure containers by using the podman backend (default) and virtualisation.oci-containers.conrainers, which supports rootless podman [1]. Imo rootless is the best and most secure way to run containers on NixOS.

    Edit: I prefer NixOS packages if available and only use OCI (Docker) containers if not. The main reason being the simplified declarative configuration through NixOS options, which can also be used inside NixOS container.

    [1] virtualisation.oci-containers.containers.<name>.podman.user

  • Deleted

    Permanently Deleted

    Jump

  • Streamlining cross posting is a good idea, as long as someone actually read the post and posts it with a purpose. On second thought, I think cross posting is simple enough, given that titles are usually auto completed.

    I'm generally against automatic cross posting bots, as they usually post duplicates, bad articles (instead of a proper source). Additionally, they often flood communities with an amount of content they are too small to handle. I.e. a lack of users to vote on posts let's good articles drown in a flood of mediocre posts. This can kill communities as they feel even more empty than with fewer posts but more comments.

  • Removed

    Would you return a hard drive with 1 uncorrectable error after 130 hours of work?

    Jump

  • If the person would answer almost instantly, 24/7, without being annoyed: Yes. Checking important information is easier once you know, what exactly to type.

  • Proton has stopped using their Mastodon account

    Jump

  • I do think the second part of your statement was unnecessary.