Max_P

Max_P, 10 months ago

Everything you do on the fediverse should be considered effectively public.

• All your votes are replicated to every instance that subscribes to the community that hosts the post.
• Posts and comments are all public (obviously)
• Both your instance admin and the remote instance admin knows who’s subscribed to what.
• Your instance admin has your IP, email, and can access pretty much everything about you.

Max_P, 10 months ago

Completely untested, but it shouldn’t be anything particularly complicated if all you want is a full image you can flash back:

<pre style="background-color:#ffffff;">
<span style="color:#323232;">dd if=/dev/sda bs=4M | zstd -T0 -9 | openssl enc -aes256 | aws cp - s3://your-bucket/backup-sda.zstd.enc
</span>

Using tar is probably a lot more efficient though, at least you only upload what’s used not the whole drive.

Or even better, use btrfs/zfs snapshots.

Max_P, 10 months ago

If possible it might be better to set the mail server to deliver to a special inbox but report the delivery as failed to the sender.

That way you get visibility on what might have gotten in there, while also getting marked as dead for anyone trying to send to it.

If nothing came in after a year or two, it’s probably safe to throw away.

Max_P, 10 months ago

Ideally, a secrets manager that you can unlock once and then give access to the secrets. You can either unlock it at boot by entering the password, or if you have a TPM, you can also do something to encrypt the main key with the TPM and then when you boot up, if all secure boot checks passes, you can decrypt that key with the TPM and unlock the secrets manager in question.

You can also store the secrets on another machine that only exposes say, the Vault API. Like a dedicated Raspberry Pi just for this function where remote access is disabled and everything, it only serves secrets. That way, you can trust the Vault logs to know when each secret was accessed and find anomalies this way.

If someone breaks in via SSH or whatever, your security already fell apart. That box can no longer be trusted for anything. Especially if they breached the root account. Doesn’t matter how big the fortress is, if you’re inside, it’s game over, it’s time to evaluate the damages and clean up.

Max_P, 10 months ago

Yeah, I went into free speech absolutism with my IRC server and it’s unbelievable how quickly people will end up testing your limits. Took less than a year before I completely backtracked and went the opposite directly and don’t tolerate slurs anymore. I just welcomes loud and obnoxious people and enforcing rules afterwards becomes pretty hard and causes tons of drama.

I mean just look at where Twitter is going now that Elon welcomed right-wing extremists. All it does is end up driving away the good people and turn into a toxic cesspool.

Max_P, 10 months ago (edited 10 months ago)

Yes: https://www.max-p.me/t/lemmy/ip.php

It’s not optimal security-wise, but it’s also not much different than your classic forums. People used to have those in their signatures all the time.

Max_P, 10 months ago

I mainly just use bare SSH and/or point my web server to my repos as I don’t really need a whole UI for stuff I’m pretty much the only one that will ever use it.

I feel like it’s a git feature that’s often overlook by those that have only used to GitHub/GitLab/Gitea before. Git was originally designed to just be a folder on a server you have SSH access (read-write) or HTTP(S) access (read-only).

I’ve used Gogs and Gitea in the past but found it overkill for my needs.

Max_P, 10 months ago

You can’t, everything on the fediverse is very public. Even if such checkbox existed, all admins still have a copy of everything in their database.

Max_P, 10 months ago

My trusty Arch ISO has never failed me, and it’s fairly easy to make one with a whole GUI if needed. But it’s not really turnkey.

Other than that, Ubuntu is still a pretty nice distro to have if only for the fairly functional GUI and drivers out of the box. Works great for fixing stuff and browsing the web for answers.

Nice thing is with Ventoy you can have a whole bunch of them for all different needs!

Max_P, 10 months ago

Another option for generating PDFs would be to render to a web page and print that. This can be done fully unattended with wkhtmltopdf.

You can easily use whichever programming language you’re familier with to render that HTML.

Otherwise some database clients have the option to export to CSV, which you can then import or copy paste into a spreadsheet and print that.

Max_P, 10 months ago

I had rolled my own PDF generator with an entire layout engine before I found this. I was disappointed but immediately threw it all away in favor of that, because it’s so much easier. It’s just soooo damn much easier to use than keeping adding features to a custom engine. It handles CSS print stylesheets pretty well too, so you get to do all your page breaks and everything and the output is pretty clean and usable.

I think it does generate mildly heavier/complex PDFs but at least it looks great.

PHP PDF libraries 10 years ago were awful.

Max_P, 10 months ago

For AppImages specifically, the guy that made the tech has had a lot of controversial arguments and opinions and a general unwillingness to accept change. Things like intentionally making it so Wayland doesn’t work because he dislikes Wayland. Also dropped a PR for AppImages for things like OBS but then refused to take responsibility for making sure all the features works and maintaining it, and then throwing a fuss when the OBS maintainers ultimately decided to not move forward with it due to lack of support commitment. Dude wanted to throw all the burden on the OBS team and then proceeded of accusing them to be paid by RedHat to favor Flatpaks. Also got mad that distros stopped shipping some outdated/unmaintained libraries AppImages relies on and refuses to upgrade it. Just massive ego problems overall around his pet project that it AppImages.

• github.com/obsproject/obs-studio/pull/2868
• gist.github.com/…/9feb7c20257af5dd915e3a9f2d1f227…
• gist.github.com/…/3de4f97598d89df627690bbe4f8c402…

Max_P, 10 months ago

– People choose to share nudes or go into porn for a very wide variety of reasons, and you should not be assuming anything about their self-esteem, dignity or self-worth, because you don’t know them or anything about them other than they chose a different lifestyle than yours.

I have an entire friend group that shares nudes like it’s selfies because for us it’s just body parts like any other and we can admire the beauty of the human body. No feelings of vice or dirtiness involved whatsoever. I can go around seeing naked people and just appreciate the beauty without feeling dirty or even thinking about sexual intercourse and look respectfully. I feel comfortable being naked around my friends, I’ve been around friends literally hooking up next to me, it’s no big deal at all. I’m cute you’re cute, do you wanna sword fight? I’ll happily talk about my sexual life (within respect of privacy of course). I’ll talk you through your kitty issues and not think any differently. It’s healthy in my opinion.

IMO healthy porn exists, there’s a whole world between anti porn and hardcore fetish porn. I see nothing wrong with a casual pair of boobies or a dick.

Some people are indoctrinated by religion to feel like their body is dirty and needs to be hidden away, and feel shame to even think about sex or feel sexually stimulated by anyone but their spouse, and that’s okay if that’s their choice. And for some people it’s just normal life stuff. I personally think religion is harmful and worthless but I don’t go around calling people practicing it low life sheeps with no self worth or sexually frustrated closeted perverts.

Max_P, 10 months ago

To be fair, Jerboa barely has any assets. Basically just an SVG and a few WebPs for the icon and that’s it.

Those can increase the size of the app really fast. Think something like just a nice welcome screen with like 5 pages with images that shows you how to use the basics of the app: right there already you need to include those in a few different resolutions for different form factors. Probably at least a few MBs just for that.

It does help to not include proprietary bloated libraries, but code size is not what generally makes the average app big, it’s the assets. Liftoff is 10MB, Thunder is 26MB, they both have a bit more visual stuff than Jerboa.

Max_P, 10 months ago

Never colocated, but did rent baremetal from OVH back when they didn’t have any KVM and all you could do is wipe/reinstall, reboot and boot into a 2-3 releases old Debian recovery.

Definitely seconding the KVM remote access part: you really, really want that, or at least some way to hard reset your server if it crashes. I can’t stress this enough. Even if you think you’ll never need it, you never know when you’ll have a kernel panic or need to do some boot troubleshooting, even just to run fsck. It’s absolutely nerve-wracking to reboot a server you don’t have any way to access other than SSH and looking at that ping window for 2-5 minutes while the thing boots back up and wondering it it will come back online or not.

If you don’t have IPMI and can’t have some sort of KVM for your server, I highly recommend having at least a PiKVM or something in there to be able to do remote troubleshooting. Ideally I also recommend (if no IPMI) setting up some sort of preboot environment you know will reliably boot (maybe something entirely in initramfs) that will boot up, get network and listen for SSH for a couple minutes before chainloading back into the main OS so that you can at least turn off firewall/reset network to known good. Anything that will give you remote access independently of your main OS.

---

At least I had access to the recovery environment from OVH, but even then, that thing took a full boot cycle to boot up + some more time for them to deliver the credentials by email (that better not be hosted on that box itself), change a config file, reboot again. Legit 10-15 minutes between each attempt and little to no way of knowing what happens until you boot the recovery again. It was horrifying, can’t recommend.

IPMI saved my ass a few times and I’m never getting another box without it.

Max_P, 10 months ago

Usually yes. That’s something you might want to discuss with the datacenter what they have to offer that way, some will give you a VPN to be able to reach it. But I don’t have experience with that, my current servers came with IPMI and I can download a Java thing from OVH to connect to it.

Max_P, 10 months ago

Just check the Private instance box in the settings and it’ll do exactly that.

Max_P, 10 months ago (edited 10 months ago)

How long has it been? If you just spun it up, what you’ve seen is just the initial pull of the content. As you subscribe, all new content will get pushed to you, but the old content never backfills.

Check your NGINX logs, you should see a bunch of POST requests to /inbox and status of 200 that looks like this:

<pre style="background-color:#ffffff;">
<span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:16 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span><span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:16 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span><span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:17 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span><span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:17 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span><span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:18 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span><span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:19 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span><span style="color:#323232;">54.36.178.108 - - [13/Jul/2023:01:10:19 -0400] "POST /inbox HTTP/1.1" 200 0 "-" "Lemmy/0.18.2; +https://lemmy.ml"
</span>

Included a bunch, as you can see they should be coming in quite frequently, basically everytime someone does something on the remote instance.

Make sure you’re subscribed to the community as well

Basic curl testing seems to rule out common routing problems, so check the lemmy logs as well just in case.

Max_P, 10 months ago

Regarding your edit, I see a pattern here: you’re only seeing content from lemmy.ml and lemmy.world. Checking your instance’s federation list, you’re using the allowlist of only those and kbin.social. That means your instance is likely to be dropping anything from other instances, and everyone in this thread is from other instances.

Max_P, 10 months ago

That’s not Google’s/Android’s fault, it’s your device’s manufacturer’s fault. Nothing stopping Lenovo from releasing updates for 5-10 years if they want, they just want you to believe it’s obsolete and hope you’ll buy a new one from them. I mean, it’s a Lenovo, what did you expect?

The ultimate proof it’s manufacturer laziness is that custom ROMs like LineageOS have updates out before the manufacturer does, if ever. I have a Galaxy S7 working just fine on Android 13, upgrade all the way from Android 7. Still runs smoother than the OS it came with too.

Max_P, 10 months ago

5 years of official support, typically custom ROMs keep it alive even longer, basically until it’s too hard to keep fixing broken features.

Max_P, 10 months ago

You can mostly pack your things and move on with GitHub too, that’s one of the key features of git. As long as someone’s got a copy of the repo, they can upload it back to GitLab or Codeberg or whatever alternative there is. You may have to rewrite a big of your CI YAML but otherwise, eh.

Max_P, 10 months ago

Steam is a good example to bring there. On a philosophical level, they’re a monopoly especially on Linux and we should be cautious. But they’ve also done so much good for gaming on Linux, it’s really hard to be mad at them.

Max_P, 10 months ago

Even if Lemmy moved away from GitHub, you’d still be relying on GitHub a ton:

• NPM is owned by GitHub which is owned by Microsoft
• TypeScript, the language that the UI is made out of, is made by Microsoft
• The Rust crate index and a lot of the crates are hosted on GitHub

Max_P, 10 months ago

The Eaton Center in Montréal has been building gender-neutral bathrooms and it seems to be working quite well. Bonus is there’s actually proper stalls that go from floor to ceiling with no gaps in them. IMO this is where the privacy matters, and then the sinks area is a lot more visible and less likely to be assaulted there.

Meanwhile in high-school in the boys restroom I’ve had someone jump up the stall on me multiple times because they thought it was funny.