Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)L

lemmyvore

@ lemmyvore @feddit.nl

Posts
4
Comments
175
Joined
3 yr. ago

  • Self hosting: real game starts today

    Jump

  • I've spent a few years at the height of the blog trend doing WordPress work. It's a very poorly designed app that has always put reliability/performance/security last and prioritized extensibility and low barrier of entry. Which is why they absolutely dominated the blog world but also why it's such a big fat juicy target.

  • Self hosting: real game starts today

    Jump

  • With WordPress (or any CMS) keep in mind that if you don't really need visitor-facing dynamic features (like comments), then you can self-host the admin and content editing completely privately, and only export a static "dump" of the finished website pages as plain HTML/CSS/JS and images.

    You can serve these static files fairly efficiently yourself with a small HTTP server, or upload to a CDN service which will take care of things like redundancy, availability, replicated content for faster access from certain geographic areas, you won't care about denial of service or bots etc.

    Meanwhile your CMS software is completely isolated from break-ins or drive-by bot attacks. As a perk, you can experiment with different CMS freely without fundamentally changing your approach, because they all produce static files one way or another. You can try for example Hugo, or a fediverse-enabled microblogging app like Pleroma, Misskey or even Mastodon.

  • "We Listened" - Commodore Reduces The Price Of Its Forthcoming Callback 8020 'Dumbphone'

    Jump

  • They mean new old stock, not used phones.

    Security updates... meh, it's a mixed bag. Outside of maybe Google I really doubt any manufacturer bothers to keep their Android phones super up to date with all the possible fixes, even within the support period.

    And as for the privacy angle... honestly the manufacturer is usually the first one to spy the shit out of you. Using Google services while worrying about a hypothetical security breach is really ironic.

  • "We Listened" - Commodore Reduces The Price Of Its Forthcoming Callback 8020 'Dumbphone'

    Jump

  • Lol Whatsapp as a system app sounds like a nightmare.

    The usuall approach established by Samsung etc. is to bundle a few "shim" apps as system apps for Meta. One shim is used by the regular Meta apps to bypass restrictions and talk to each other, one collects data from any app that uses the Meta ad network, and some are there in case you install the corresponding user app (eg. Facebook) to give it system privileges.

    I mean it ends up technically the same as having Whatsapp bundled outright, but you gotta give props to a manufacturer so shamelss they don't even pretend to hide it. 😃

  • “Gaming is becoming unaffordable” — Xbox CEO says the industry has an accessibility crisis

    Jump

  • The problem is that making games (and software in general) has become more high-level, and enshittification has also gotten rid of highly skilled people. So the top studios in the industry are not capable of making resource-efficient, beautiful games anymore. Not because it's physically impossible, but because they're not geared for the processes and decision-making that would allow those games to be made.

    When you switch from an artisan mindset to a mass-manufacturing and outsourcing mindset without exercising strict control you eventually become utterly dependent on service and product providers that will see to your costs going up so you'll keep paying more for less.

    All the large studios will come to a breaking point eventually because it's unsustainable, and will be acquired for the franchise rights by corporations that make their money in unrelated industries. But the PC platform is also breaking down so this might be a moot issue in 10 years from now.

  • “Gaming is becoming unaffordable” — Xbox CEO says the industry has an accessibility crisis

    Jump

  • isthereanydeal can import your steam wishlist, and you can set a price threshold and other criteria on it. I have a $10 threshold on mine and there's plenty of stuff on there all the time.

  • Software engineers are facing an 'identity crisis bordering on depression,' Menlo Ventures partner says

    Jump

  • That's a very warped impression of Silicon Valley. And it probably comes from Hollywood movies, which is super ironic since you mentioned writers and filmmmakers.

    Dumb representation of computers in movies has done more to harm their image than actual software ever did. Most of the AI hype is based on fantastic notions of AI as seen in movies.

  • Local Brand Realizes Customers Hate Its AI Ads, Switches to Charming Homemade Ones Instead

    Jump

  • The difference is that it used to be harder to concentrate massive wealth in the hands on one individual. It used to require very large companies, which were controlled by multiple people through shares and board positions. Companies themselves weren't allowed to grow too massive or achieve monopolies.

    Lately all checks have gone out the window which has resulted in single individuals having control over mind-boggling amounts of resources. This changes the dynamics a lot because an individual will act very differently from a large board or shareholders.

  • AMD denies researcher a $10,000 bug bounty after fixing critical auto-updater vulnerability — security flaw took 124 days to patch

    Jump

  • HTTPS is privacy in transit. It has no say into what's being downloaded.

  • greenery-beacon: Small and standalone mDNS responder powered by the Traefik API.

    Jump

  • You're right I don't think it can, can only advertise explicit labels.

  • LibreOffice slams Euro-Office as ‘de facto ally’ of Microsoft

    Jump

  • It's not a fine standard. Microsoft filed it with the express goal of preventing ODF from becoming the prevailing document standard, not with the goal of documenting OOXML. It's intentionally obfuscated and kept different from MS Office. It's not a standard it's a red herring.

  • Radicale: Can someone please offer any guidance on usage and security. Om abit lost

    Jump

  • Please note that to use "bcrypt" for htpasswd_encryption you need the bcrypt python module installed. Some distributions of radicale (eg. some docker images) don't have it.

    It's fairly safe to set it to "md5" instead. It does not mean plain MD5 (one iteration), it does several hundred rounds of MD5 plus a salt.

    For the curious, the advantage of bcrypt over a single-iteration, fast hash like MD5 is that bcrypt lets you set the hashing effort, while MD5's goal is to do it as fast as possible.

    This becomes relevant when someone steals your password file and tries to brute force it by hashing a bunch of dictionary words and random strings (plus a bunch of salts) until something matches. A fast single-iteration hash like MD5 will let them do that much faster than a bcrypt hash set to a higher effort; it can mean the difference between finding a password in one week vs finding one in 100 years. That's what the hundreds-of-iterations MD5 is trying to achieve, it's a "poor man's bcrypt".

  • Local Brand Realizes Customers Hate Its AI Ads, Switches to Charming Homemade Ones Instead

    Jump

  • The former.

    Evil billionaires are more of a 2020's thing.

  • LibreOffice slams Euro-Office as ‘de facto ally’ of Microsoft

    Jump

  • Euro-Office and OnlyOffice don't "only support" OOXML. Where did you get that idea?

    From the fact ODF "support" is an awkward import/export function. It's not a first class format.

    The code is open so where do you suppose all this supposed spyware is hiding?

    On their live service. They don't publish the spyware with the code they choose to open, obviously. 😃

  • Security considerations about hosting Immich from home

    Jump

  • Add mTLS to the reverse proxy and to the Immich client app and forbid access without it.

    The mTLS certs can be self-generated. There are tutorials for generating your own CA and individual mTLS certs for each device. Then you put the ca.pem file in a place accessable by NPM and add a couple of commands to the "Advanced" tab of the Immich proxy host, and you put the mTLS cert on the phone and load it into the Immich app.

    mTLS is a super strong method, not only does it serve as great authentication for that particular device, it also checks the TLS connection for tampering so it can't be hijacked even if somehow you get rogue certificates loaded on your phone, you can revoke certs if your phone gets lost or stolen etc.

  • Security considerations about hosting Immich from home

    Jump

  • It supports it on the iOS client as well but last time I tried it would always lose the mTLS setting on its own after a while. I had to resort to the other method they offer, secret key in a custom HTTP header.

  • Radicale: Can someone please offer any guidance on usage and security. Om abit lost

    Jump

  • DAVx5 also includes good security, like the ability to use mTLS to secure your access to Radicale adequately even if you expose it over the open Internet. It's also being actively developed, with updates coming out every few weeks.

  • Radicale: Can someone please offer any guidance on usage and security. Om abit lost

    Jump

  • InfCloud is the last and only functional, standalone, web-based CalDAV frontend currently in existence. It doesn't really matter how crap it is because there's no alternative. And besides CalDAV/CardDAV are not exactly rapidly-evolving anymore.

    There are a handful of alternative frontends bundled with other webapps, for example Nextcloud includes one, but if you don't want to install Nextcloud just for that you're stuck with InfCloud.

    I really wish someone would make a modern standalone webapp for this but no luck so far.

    Having worked at some point on some calendar interfaces I can appreciate why, because they're super intricate and difficult.

  • Radicale: Can someone please offer any guidance on usage and security. Om abit lost

    Jump

  • Start by using a 3rd party contacts app (or dialer+contacts as they usually come, at least on Android). Google's Contacts app only works with Google.

    The 3rd party app should let you explicitly select which sources of contacts you want to use. After you set up DAVx5 you should see it available as a source.

    The app I use (True Phone, com.hb.dialer.free) shows a list of all sources under "Settings > Contacts > Contacts to show" and you can check/uncheck the ones you want.