Skip Navigation

dan

@ dan @upvote.au

Posts
0
Comments
1064
Joined
3 yr. ago

Aussie living in the San Francisco Bay Area.Coding since 1998..NET Foundation member. C# fan https://d.sb/Mastodon: @dan@d.sb

  • Vulnerability giving attackers full control of Macs is under active exploitation

    Jump

  • I don't trust the prebuilt images that providers provide so I like installing from my own ISO.

    cloud-init is useful sometimes, but I recently had an issue with Alpine's alternative implementation (tiny-init) where it was setting a root password I didn't know. It was pulling it from some sort of metadata, but there was nowhere in my provider's control panel to set the default root password. Alpine also doesn't have any documentation about how to disable tiny-init, so I had to read the code and figure it out myself (create a file called /etc/tiny-cloud.disabled before init runs).

    cloud-init also can't configure LUKS encryption. I know its usefulness is limited on a VM (since the provider can snapshot the memory and retrieve the encryption key that way), but it's still useful when the VM isn't running or if you stop using that provider to ensure they can't recover the data, and it's required in some cases (eg Plaid required me to certify that all data is encrypted at-rest before they gave me access to their API)

  • Vulnerability giving attackers full control of Macs is under active exploitation

    Jump

  • Having a default firewall is also a blessing, which all good routers should do. NAT is a curse.

  • Vulnerability giving attackers full control of Macs is under active exploitation

    Jump

  • The firewall is on the router.

  • Vulnerability giving attackers full control of Macs is under active exploitation

    Jump

  • The underlying protocol (RFB) is very simple to implement, and in fact some friends and I implemented both a VNC client and server as part of a project we worked on at university nearly 20 years ago.

    Because of this, it's common to find it in various places, especially for interacting with systems that don't have an OS installed yet:

    Most good VPS providers provide VNC access so you can set up your own OS from an ISO, use Clonezilla to clone the drive over the network, recover files if the drive gets corrupted somehow, etc. It's a built-in feature of KVM/libvirt that the providers usually expose using something like NoVNC in their control panel. The common off-the-shelf control panels (Virtualizor, SolusVM, Virtfusion, Proxmox, etc) all have it as a standard feature.

    A lot of IPMI/BMC and KVM-over-IP systems use VNC too, for a similar purpose, just for physical hardware rather than VMs. The protocol being very simple makes it easy to build a simple version into an embedded system. This is also usually accessed via NoVNC in a web UI.

  • Vulnerability giving attackers full control of Macs is under active exploitation

    Jump

  • One of the ways it can happen is if a router doesn't have a proper IPv6 firewall.

    The majority of internet users in the USA have IPv6 connectivity - something like 55-60% overall, and close to 100% on some networks. T-Mobile's network is 100% IPv6-only, using 464XLAT for connectivity to legacy IPv4-only servers. Most Comcast customers have IPv6 too, as they were the first major ISP to roll out IPv6, close to 15 years ago now.

    Without an IPv6 firewall on the router, all devices on your network are directly accessible from the outside world (unless they're running their own firewall, of course). At least Windows ships with a firewall enabled by default, which reduces the impact for Windows users.

    I've seen this in places you wouldn't expect it, too. TP-Link's prosumer/SMB 10Gbps router (Omada ER8411) didn't have an IPv6 firewall until about a year after launch. I had to disable IPv6 until then. They did add it, but I've since switched to a Unifi Cloud Gateway Fiber.

    Thankfully I haven't seen it recently, so maybe it's not an issue any more on modern hardware.

    NAT is a hack, not a security feature, and IPv6 removes the need for it. The firewall is the security feature. (edit: the firewall on the router)

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • I think people will eventually have to get used to paying for things though, if bots / AI / ad blockers kill off the feasibility of online advertising. Either that or everything becoming a freemium service with major limits for free users.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • So I can install any software I want. I'm running my own Lemmy server. I host Odoo and n8n for my wife's business. I have servers running Borgbackup and Borgmatic for backups. And a bunch of other stuff.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • It's the same way that taxes work. Rich people contribute more than poorer people, but everyone can use things funded by public money (parks, police, fire fighters, public transport, schools, health care outside the USA, etc).

    I actually wonder if there should be more taxpayer-funded online services. Lemmy's development was partially funded by government money (NLNet Foundation via the European Commission) for example.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • I've tried that before, but barely anyone donates. People expect the world for free.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • I agree about the automated scaling, but with VPS hosting you can usually have several hot spares to handle traffic spikes, and still spend less than something like AWS. Most good VPS hosts will let you create a private network between your VPSes. 1000x spikes aren't very common.

    CDNs are pretty easy in general, especially if they support origin pull.

    I don't like keeping all my eggs in one basket, so I use a few different providers.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • Yes, because a Linux server with root access is much more powerful than a platform like Cloudflare.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • There seems to be two groups of people:

    People that use services like AWS and pay hundreds (or more) per month: "Wow, hosting is so expensive now!"

    People that host a bunch of stuff on a $40/year VPS: "Wow, hosting is so cheap now!"

    I've got several VPSes with 40Gbps (shared) networking, 8 or 16GB RAM, decent amount of space on RAIDed enterprise NVMe SSDs, fast AMD EPYC CPUs, that cost less than $60/year. 20 years ago before VPS hosting became popular, you'd need to pay at least $100/month for a dedicated server with a consumer CPU, single IDE hard drive, tiny amount of RAM, on a 100Mb/s connection.

    Not to mention being able to host a bunch of stuff at home for cheap with a low-power single-board or mini PC., and Hetzner making dedicated servers very cheap too.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • every time I have an idea for some little quality of life tool that involves pulling data from a site I would normally have to browse to directly, I can't do it because everything is captcha'd to all hell.

    On the flip side, a bunch of services / web apps (mostly paid ones) are adding APIs to become "AI native"... but you can use those APIs without having to use AI too.

  • Cloudflare says humans could become a "rounding error" as bots generate 1,000 times more internet traffic

    Jump

  • A lot of sites wouldn't exist without ads, because they want their stuff to be freely-accessible and don't have any other revenue streams. It would also cut off lower income people that couldn't afford to pay.

    The only business models that have really worked online have been:

    1. Ad-supported.
    2. You pay for the service yourself, like a monthly subscription.
    3. Someone else pays for the service for you, for example freemium services (paid users subsidize the free users), a lot of Lemmy servers (admins cover the hosting costs), etc.

    If ads go away, a lot of sites/services would have to become paid services, and smaller ones might just shut down entirely. We'd end up with even more consolidation of the market.

  • Cory Doctorow: The people who tell you ‘AI is changing everything’ are lying

    Jump

  • I generally respect this guy's opinion (I probably use the term "enshitification" multiple times a week

    A lot of people don't use it the way he used it though. He used it specifically for two sided markets (eg a service that has both businesses/advertisers and personal users) where the focus shifts to the business customers, but people have started using it to mean anything that used to be good but isn't good any more.

  • cron PATH bit me again today

    Jump

  • I use healthchecks + runitor for notifications. Would recommend. I posted another comment about them.

  • Linux Cat

    Jump

  • OK, TIL you can just do <foo.txt. I didn't think that worked. Thanks!

  • cron PATH bit me again today

    Jump

  • I'd recommend self-hosting healthchecks and using runitor for your cronjobs. Runitor pings healthchecks when the cronjob starts, then pings it again on completion with the status (success or fail) along with the stdout and stderr.

    Healthchecks can be configured to expect a ping periodically (once per day, once per hour, whatever) and alert you if it doesn't receive one.

    For backups, Borgmatic has a healthchecks integration.

  • Linux Cat

    Jump

  • Thanks - I didn't know this either!