lemmyvore

Eh, pods are easier to knock down than glasses.

The small, light posts are called typically called traffic poles, at least around here. A bollard is a heavy, strong thing made of concrete or metal. The poles are meant to direct traffic and to gently deter drivers from crossing them. Bollards are intended to stop vehicles dead without giving a shit how much damage they cause.

Poles can be very good for traffic when used correctly but sometimes street planners make mistakes. Either that or people insist on going against what the poles are suggesting.

Lol I don't know, I'll have to try. I would've never thought of it. If it works it's definitely not intuitive. Dark art indeed.

I recommend taking a look at the new Tailscale access controls > policies (aka "grants"). Much easier to understand than their old ACLs. You can quickly draw up rules that only let specific devices access specific nodes and even only specific ports.

There's one small potential point of confusion, in that you can't use node names directly in the rules. You have to go to access controls > definitions > hosts and make up a name there assigned to the node IP address, and then you can use that name in a policy.

In other words, even if you already have a tailnode called "nas" with a fixed IP, you can't just say "nas" in a policy. You have to go to hosts, define one called "nas" that points to that tailnode's IP, and then you can use "nas" in the policy... 🤪

I understand the logic, which is that hosts and definitions in general are much more powerful and can define IP netmasks and IP groups and then you can use those groups in policies... but boy, the redundancy when you have to do this for single nodes that are already assigned a name and an IP is rubbing me wrong.

It's very easy to make a custom CA and issue certs. Here's a good tutorial.

Unfortunately in practice It depends greatly on what's on the other side (the client app). Some examples:

DAVx5 on Android works perfectly fine and uses the client cert from the system store. 10/10, this is how all apps should work.
Ntfy on Android works perfectly fine but wants the client cert file loaded in the app, it doesn't use the one loaded in the system store. This sucks because instead of loading a cert into the system store once and then deleting it you have to keep the cert file around for this kind of apps, in Android shared storage, which is accessible to all apps.
Same for Immich, wants the cert loaded in the app. Also, it will randomly lose it (on both iOS and Android). Yes, you heard that right. So it's basically useless and I had to resort instead to a key in a custom HTTP header; which isn't exactly the same as mTLS, but helps secure the service at reverse proxy level so it's better than nothing.
Firefox on Android will use the cert from the system store, and then it will crash. Again, useless.

Oh did I mention how you get a mTLS client cert to an app on an iOS device? You send it over email to an account that the device has access to through the Mail app, then share the attachment. Yep.

It's also not exactly straightforward to use mTLS with reverse proxies.

Let's take for example Caddy and say you want unconditional mTLS for all reverse proxy hosts. Easy enough:

    
tls /path/to/domain-cert/fullchain.pem /path/to/domain-cert/privkey.pem {
  client_auth {
    mode required
    trust_pool file /path/to/custom/ca.pem
  }
}

But suppose you don't want unconditional mTLS, you'd like to let clients in if they have mTLS or a custom header, or do different things depending if the client has valid mTLS or not. Does Caddy offer a built-in conditional to act on mTLS status? Nope!

As a workaround I'm setting the client_auth mode to verify_if_given and then using a DIY conditional that checks if the variable http.request.tls.client.certificate_der_base64 is empty or not. But it's undocumented so who knows if it may break at any point.

For reference, how you handle both custom headers and mTLS at once (after setting the mode as I've mentioned):

    
@immich host "whatever.example.com"
handle @immich {
  @not_authorized {
    not header X-Custom-Pass "LONGRANDOMKEY01" # jim
    not header X-Custom-Pass "LONGRANDOMKEY02" # bob
    vars_regexp {http.request.tls.client.certificate_der_base64} ^$
  }
  error @not_authorized 403
  reverse_proxy http://immich.lan:port
}

The nested "not not" is required because Caddy can only do logical AND in group conditionals, so to do logical OR you basically have to do NOT (NOT a AND NOT b).

Yeah it's a very good rule of thumb to always bind to explicit IPs.

Another issue with 0.0.0.0 is that it will bind to basically everything, including whatever bridge or tunnel interfaces you may have up on that machine. And that's how you end up with random services exposed through VPNs and God knows what, when you thought it was a "private" service that only lives on your LAN.

True but they can't rely on the US alone. They have to do business elsewhere. Funding Firefox is a ridiculously cheap way of making sure they can operate with impunity everywhere. It's brilliant, really.

In the future it will probably come out there was a massive backroom deal. Neither this nor dropping Windows Phone have made any sense.

It also opens the possibility of a manifest v4 which restricts even further what ad blockers can do. But if they do in small steps they hope people will just accept it. They're basically trying to boil the frog.

But this is a best case scenario: bugs accumulated over the years are being spotted automatically and reviewed by experienced devs. It was normal to have a few updates that are very large due to all the accumulated cruft.

The bigger deal that will be an issue going forward is the bogus bug reports, not the good ones. The legit reports will dwindle eventually, bullshit reports will keep coming.

I mean, anybody can post anything anywhere, and it will get synced. Many communities aren't even modded. But removing vile stuff is a burden to put on people to begin with, and I think most Lemmy instances are poorly equipped to deal with this automatically.

I keep seeing "escape the container" mentioned like it's a very common occurance. Is it really? I've looked up escape CVE's and they seem to be few and far apart, they're usually tricky to pull off, and when one comes out it's a big deal and they get fixed right away (obv).

Actually my issue isn't "do escape CVE's exist", it's more like, should I really waste my time planning for it? It's like planning for file permissions not to work, or logins to be bypassed.

I get that shit happens and why defense in depth is a thing but how do you defend from something so fundamental? If you operate under the assumption that containerization can be by bypassed, and virtualization can be bypassed, where do you draw the line and what do you do, run each app on a standalone physical box?

udev rules is a bit of a deep end dive tbf. There are enough Linux distros where you can stick to the desktop most of the time.

People that can rub two neurons together have figured out they can get their 10yr old nephew to install something for them... so the included OS means nothing besides how it affects the final price. They'll buy a laptop with Windows/Linux/no OS or whatever on it. In markets that don't allow computing devices to be sold without an OS it doesn't even have to be Linux, the vendors and manufacturers will happily slap FreeDOS on it to bypass the regulation.

No need, you can just use an IR spotlight to blind the camera. Unlike the military you're not trying to hide the vehicle.

But either way you're actively trying to avoid being picked up by speed cameras so you get a fine.

Let's be honest... people who can't figure out how to deal with Windows licenses wouldn't be able to deal with a switch to Linux either.

Yeah but as long as the manufacturers keep selling all their production for real money, everybody else is screwed and prices are going up.

I see. I'm in Europe and it's not very common there so that's why.

Not sure about american plates, but in most jurisdictions licence plates are optimized for easy OCR:

Are they? Off the top of my head Germany is the only country I can think of that uses such a font (FE-Schrift).

lemmyvore

@ lemmyvore @feddit.nl

Posts

4
Comments

172
Joined

3 yr. ago

lemmyvore

Apple is working on camera-equipped AirPods that appear to be nearly ready to launch, based on a video MacRumors found in the macOS Tahoe 26.7 release candidate.

Tesla Robotaxi Mows Down Bollards & Keeps Driving, After “Impeccable” Record Touted on Stock Call

Anybody here does mTLS?

Anybody here does mTLS?

Anybody here does mTLS?

[solved] Why can't I access this service over the LAN?

Firefox is now the last major browser that still supports uBlock Origin

Firefox is now the last major browser that still supports uBlock Origin

Firefox is now the last major browser that still supports uBlock Origin

Linus Torvalds says AI has made 'huge' Linux kernel updates the new normal

I need a new hobby, I'm going to set up my own Lemmy instance. Am I an idiot?

I need a new hobby, I'm going to set up my own Lemmy instance. Am I an idiot?

Amid RAM price hikes, Microsoft reportedly raises Windows license cost, forcing OEMs to hike prices even further on hardware

Amid RAM price hikes, Microsoft reportedly raises Windows license cost, forcing OEMs to hike prices even further on hardware

Amid RAM price hikes, Microsoft reportedly raises Windows license cost, forcing OEMs to hike prices even further on hardware

A cybersecurity researcher covered a Toyota in an AI-generated pattern to confuse Flock cameras

Amid RAM price hikes, Microsoft reportedly raises Windows license cost, forcing OEMs to hike prices even further on hardware

2027 RAM Capacity Has Reportedly Been Sold out

Flock misread license plates in 71% of the alerts it sent to police in one California town

Flock misread license plates in 71% of the alerts it sent to police in one California town