Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)M

moonpiedumplings

@ moonpiedumplings @programming.dev

Posts
21
Comments
418
Joined
3 yr. ago

  • crates.io front-end and its accessiblity issue(s)

    Jump

  • Only possible to authenticate with Github

    They seem to be working on it

    If you go to a page which doesn't exist, one would expect to get the 404 HTTP code (not found). So let's try when we query a crate which doesn't exist:

    This is the only one I somewhat disagree with. If you give a 403 error whenever you don't have permissions to access a page, and a 404 whenever you access a page, it becomes possible to discover parts of the website that exist but you can't access.

    It's because of this, that both Github and Forgejo just return 404 errors when you access a repo that doens't exist OR it's a private repo. A quick test with Codeberg against a repo that probably doesn't exist gives me an error 404 and the message:

    The page you are trying to reach either does not exist, has been removed or you are not authorized to view it.

    (emphasis mine)

    Now, I would rather see 404 errors everywhere instead of 403's. It's way more likely that you are encountering a repo or website path that doesn't exist, than you lacking privileges/auth. But, 403's everywhere is an approach I've seen done before and it makes sense when you understand why.

  • My Thoughts on the Bun Rust Rewrite

    Jump

  • Performance, it's slightly slower compared to Bun, but it is faster than Node. But it has sandboxing, which is neat.

  • My Thoughts on the Bun Rust Rewrite

    Jump

  • Deno is pretty interesting because it has built in sandboxing. By default, no code can even access the network. Everything must be explicitly allowed, including network access and environment variables: https://docs.deno.com/runtime/fundamentals/security/

    Access can be scoped pretty granularly as well, only allowing access to specific websites or env variables.

    I really like this model since it offers a strong protection against secrets stealers, which have hit NPM extremely frequently. No more of malicious NPM packages scraping the whole system to find secrets.

    It does have a performance tradeoff compared to Bun. Bun is (was?) the fastest, Node was the slowest, Deno was in the middle.

  • Why git-annex Spent 100 Hours Purging LLM-Generated Code

    Jump

  • No, I mean that the article appears to be AI slop. The "This was not X but Y" pattern is super common, and super annoying due to it's lack of brevity.

  • Why git-annex Spent 100 Hours Purging LLM-Generated Code

    Jump

  • what's the simple way to map services to subdomains instead of specifying the port number?

    Jump

  • You can use local certs with nginx proxy manager as well. You can upload certs via the web ui.

    Rather than local certs though, I would recommend buying a domain and using it locally, with https. The problem with the local cert approach outlined in the video, is that importing a root cert opens up a big security hole to MITM attacks. If an attacker gets the root certificate, they can now MITM everything else your browser is accessing. You turn the browser from one of the most secure components of a modern OS, into only as secure as the server hosting the root certificates.

    The approach I would prefer, is to buy a domain, and use it locally, using DNS-01 challenges to get letsencrypt signed certificates even from within an internal network. Both Caddy and NPM have support for DNS-01 challenges.

  • Rayfish, Iroh and Yggdrasil

    Jump

  • No, they are trivial to block using techniques like deep package inspection.

    In addition to that, they aren't truly decentralized (no decentralized network really is), both rely on relay/bootstrap servers to start up the connection. So, if you block the public relay/bootstrap servers, you effectively block access to the network.

    Tailscale, netbird also can traverse NAT.

    Iroh (the actually pretty interesting software which the vibecoded rayfish is based on) and Yggdrassil do have their uses, but evading blocks isn't one of them.

  • what's the simple way to map services to subdomains instead of specifying the port number?

    Jump

  • You want a reverse proxy. A reverse proxy reads requests to subdomains and then forwards them to ports and back.

    The easiest GUI one is: https://nginxproxymanager.com/

    But there is also just straight nginx, or you can use Caddy or traefik or anything else.

  • Avoiding Vendor Lock-in By Using KDE Plasma As Personal Knowledge Base

    Jump

  • Yes, but it looks like the xdg.user.tags and xdg.user.comments are KDE software specific, and not part of the official spec. Meaning other softwarw probably can't read and interact with those attributss in the same way.

  • Avoiding Vendor Lock-in By Using KDE Plasma As Personal Knowledge Base

    Jump

  • This workflow is tied to KDE Plasma's tagging feature. Moving away from KDE Plasma would likely mean abandoning parts of this workflow altogether.

    It looks like these tags are stored in filesystem xattrs themself, not in dolphin or kde metadata. That is, even if you load up gnome's file browser, or another file browser, it should still be able to read them.

    Nope, it looks like the tags used are KDE specific, even though any software could theoretically implement support for reading and writing them.

    https://wiki.archlinux.org/title/Extended_attributes

    https://www.freedesktop.org/wiki/CommonExtendedAttributes/

  • Do you use nix run often?

    Jump

  • I use nix-shell -p for infrequently used commands, or nix shell flake#packagename for flakes. I prefer the shell environment because I rarely need to run something only one in a session. Usually I forget the cli arguments, and then have to run --help and so on.

    For anything I need more frequently, I usually install either via home manager if I care about a specific/newer version, or just as a system package (I don't use NixOS).

  • How much do you secure a home server that's only accessible with VPN?

    Jump

  • Yes, I do lock it down. It's still worth securing it because "internal servers" can still get exposed and touched, even though there are less paths to them, and it's not as punishing to slip up vs a public server. For example, One of the wireguard client devices downloads a virus, and now you have a cyberattacker with access.

    Another problem is supply chain issues. If the distributor of a docker container is hacked, it's not that bad... as long as your kernel is up to date and is protected against some of the recent vulns, that would enable someone to break out of a docker container

    Blajah.zone's lemmy instance was hacked partially becuase internal servers weren't being held to the same security standards as the public ones:

    https://pen.blahaj.zone/supakaity/weve-been-hacked

    I had not patched these internal servers that nobody should have access to against this. Rebooting DB servers causes downtime, and in my hubris – I thought nobody should (nay COULD) be on my servers except me, right?

    I have a comment on that post with some potential solutions, that would have cut off attack paths.

    Though, I guess, it still does depend. Like if it's just gonna you wireguarding in and no one else, then the data on your devices is probably worth more than the data on the server, so no, it wouldn't be worth spending too much effort to secure less valuable data.

    But if you are handing out internal access to people, including to some relative who keeps falling for scammers, then yeah, I'd take some time to harden the systems.

  • An Anti-License Manifesto

    Jump

  • I don't like the less serious licenses because they often don't explicitly declare that your software is distributed with no warranty.

    This makes you liable to be sued in certain jurisdictions, where simply distributing software is assumed to also provide support, or you could be held responsible for damage it causes or misuse.

    Of course, the chance of someone suing you is extremely slim. And courts are ran by humans, who can interpret the spirit of the law, rather than the letter, so I would hope they would be gracious and understanding of the open source model. But it's better to just not take chances.

  • NutriTrace v1.0.0-rc.53 released: statistics reorder + hide, bulk delete on Foods/Meals/Recipes, OFF serving sizes

    Jump

  • https://programming.dev/comment/24515044

    Same problem is present here. Uses JWT's for auth.

    Edit:

    Using jwt's for auth isn't bad, it's good and quite common The problem is when they are used in place of actual bearer/cookie/session auth methods. As I understand it at least, a jwt token with a lifespan greater than 5 minutes is a red flag.

  • Is there a federated fandom wiki alternative?

    Jump

  • https://getindie.wiki/

    This is a browser extension that shows you the non fandom instances of wiki's, if they exist. Or, it can also use breezewiki as a privacy preserving frontend to fandom pages.

    The indie wiki's aren't usually federated, though.

  • Example Flux Kubernetes Setups

    Jump

  • I don't use a UI.

    I don't use flux's kustomize (there is also kustomize by kubernetes.

    I use flux for installing helm charts, mostly.

    Repo: https://github.com/moonpiedumplings/flux-config

    It's not up right now though. I am currently revamping it, which will also involve reorganizing the repo. I really dislike that I didn't use (flux's) kustomize, which is one of the things I would like to fix.

    I'm on my phone rn, if I get to this post again from my computer later I will add longer/further thoughts.

  • Is a FOSS decentralized peer-supported backup service feasible?

    Jump

  • i2p is based on freenet (back when it was known at freenet).

    I don't think it supports storage though, just routing.

  • Is a FOSS decentralized peer-supported backup service feasible?

    Jump

  • It's tough. The problem is that, on the tech side, technically, torrents don't have to seed. People have made fake torrent clients that only pretend to seed, but actually only download. The IP's are detected and then banned, but it's a cat and mouse game.

    Enforcing it with backups is a similar struggle. There exist paid solutions, that use crypto to pay for decentralized storage. You "rent" out some of your storage, or by some using crypto. Filecoin, sia, storj, and so on.

    But these have flaws too. Often, there level of decentralization is questionable, and the maker of the crypto takes a cut, plus there are issues with using a custom crypto coin as well. The coin's value can fluctuate — there are challenges with it simultaneously be an investment, AND a currency, but that's what often happens.

    A better solution, is just to trade hard drives with your friends, who you know in person. Or maybe trust online, at least. Just give them an encrypted backup. And then they give you an encrypted backup.

    In my opinion "encrypted, decentralized backups", is the kind of problem that is extremely difficult to solve technically, but is trivially solved via touching grass. I don't really like the technical solutions people have presented to this problem, and a local community is a much simpler way to solve these challenges.

  • Setting up local Caddy with Porkbun

    Jump
  • Linux @programming.dev
    moonpiedumplings @programming.dev

    AnuraOS — web based OS that uses a wasm emulator to give you a real linux system, running entirely in your browser

    github.com /MercuryWorkshop/anuraOS