digdilem

digdilem, 5 days ago

This is exactly why I never buy Early Access games. The biggest thrill for me is starting a new game, and if that isn’t as good as it can possibly be, then that opportunity has been wasted.

Sure, it /may/ get better at some undefined point in the future, but there’s just so many games out there that are complete, and won’t require re-visiting at some point because they got better. Once that first play is gone, it’s gone.

digdilem, 7 days ago

And it was a good design - it’s universal (aha) adoption proves that.

Those of us old enough to remember the pain of using 9 and 25 pin serial leads and having to manually set baud rate and protocols, along with LPT and external SCSI and manufacturer specific sockets probably agree this was a problem that needed solving, and USB did do that.

digdilem, 9 days ago

I’ve had to scroll down eight pages to find a post that seems to actually address the good points raised in the article.

digdilem, 11 days ago

It’s actually 250 euros for the top tier (267 $us)

I mean, seriously, what the actual fucking fuck?

digdilem, 21 days ago

I mean - I switched my attention to Haproxy. And yes, no argument there.

digdilem, 21 days ago

Fail2ban is something I’ve used for years - in fact it was working on these very sites before I decided to dockerise them, but find it a lot less simple in this application for a couple of reasons:

The logs are in the docker containers. Yes, I could get them squirting to a central logging serverbut that’s a chunk of overhead for a home system. (I’ve done that before, so it is possible, just extra time)

And getting the real IP through from cloudlfare. Yes, CF passes headers with it in, and haproxy can forward that as well with a bit of tweaking. But not every docker container for serving webpages (notably the phpbb one) will correctly log the source IP even when passed through from Haproxy as the forwarded-ip, instead showing the IP of the proxy. I’ve other containers that do display it, and it can obviously be done, but I’m not clear yet why it’s inconsistent. Without that, there’s no blocking.

And… You can use the cloudflare IP to block IPs, but there’s a fixed limit on the free accounts. When I set this up before with native webservers and blocked malicious url scanning bots, then using the api to block them - I reached that limit within a couple of days. I don’t think there’s automatic expiry, so I’d need to find or build a tool that manages the blocklist remotely. (Or use haproxy to block and accept the overhead)

It’s probably where I should go next.

And yes - you’re right about scripting. Automation is absolutely how I like to do things. But so many problems only become clear retrospectively.

digdilem, 21 days ago

Some nice evil ideas there!

digdilem, 21 days ago

Maybe? It feels like the kind of stupid that you really need a human to half-ass it to achieve this thoroughly though.

digdilem, 21 days ago

Doh - another example of my muddled thinking.

Fail2ban will work directly on haproxy’s log, no need to read the web logs from containers at all. Much simpler and better.

digdilem, 21 days ago

Thanks, I’ve not heard of that, it sounds like it’s worth a look.

I don’t think the tunnel would complicate blocking via the cloudflare api, but there is a limit on the number of IPs you can ban that way, so some expiry rules are necessary.

digdilem, 21 days ago

Yep - agree with all of that. It’s a fault of mine that I don’t always step back and look at the bigger picture first.

digdilem, 21 days ago

I’ve just installed crowdsec and its haproxy plugin. Documentation is pretty good. I need to look into getting it to ban the ip at cloudflare - that would be neat.

Annoyingly, the claudebot spammer is back again today with a new UA. I’ve emailed the address within it politely asking them to desist - be interesting to see if there’s a reply. And yes, it is Claudebot 3 - AI.

UA:like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

digdilem, 21 days ago

It’s back today with a new user-agent, this time containing an email address at anthropic.com - so it looks like it’s Claude3, a scraper for an AI bot.

digdilem, 22 days ago

Obesity is increasingly a problem in low- and middle-income countries.

Isn’t that always going to be the case, regardless of ingredient adjustment? It feels like people who have had very little food will tend towards over-compensating during times of glut - perhaps not so much the generation directly affected, but the care they give to next generations.

As an example vaguely related but less extreme; I was born in 1970 in England to a lower middle-class family. My parents were wartime and post-war babies who had experienced rationing and as a result, I have very strong recollections of being made to “clear your plate” before I could leave the table. (Ironically given this topic, the “there are starving children in Africa who would like that” line was given quite often)

Wasting food was the absolute highest sin I could commit and that’s stayed with me to this day.

digdilem, 28 days ago

Anyone else find themselves singing this headline to the tune of The House of the Rising Sun?

digdilem, 1 month ago

This is a common thing one needs to do. Not all linux gui tools are perfect, and some calculate number differently (1000 vs 1024 soon mounts up to big differences). Also, if you’re running as a user, you’re not going to be seeing all the files.

Here’s how I do it as a sysadmin:

As root, run:

du /* -shc |sort -h

“disk usage for all files in root, displaying a summary instead of listing all sub-files, and human-readable numbers, with a total. Then sort the results so that the largest are at the bottom”

Takes a while (many minutes, up to hours or days if you’ve slow disks, many files or remote filesystems) to run on most systems and there’s no output until it finishes because it’s piping to sort. You can speed it up by omitting the “|sort -h” bit, and you’ll get summaries when each top level dir is checked, but you won’t have a nice sorted output.

You’ll probably get some permission errors when it goes through /proc or /dev

You can be more targetted by picking some of the common places, like /var - here’s mine from a debian system, takes a couple of seconds. I’ll often start with /var as it’s a common place for systems to start filling up along with /home.

<span style="color:#323232;">root@scrofula:~# du /var/* -shc |sort -h
</span><span style="color:#323232;">0       /var/lock
</span><span style="color:#323232;">0       /var/run
</span><span style="color:#323232;">4.0K    /var/local
</span><span style="color:#323232;">4.0K    /var/mail
</span><span style="color:#323232;">4.0K    /var/opt
</span><span style="color:#323232;">168K    /var/tmp
</span><span style="color:#323232;">4.1M    /var/spool
</span><span style="color:#323232;">5.5M    /var/backups
</span><span style="color:#323232;">781M    /var/log
</span><span style="color:#323232;">787M    /var/cache
</span><span style="color:#323232;">8.3G    /var/www
</span><span style="color:#323232;">36G     /var/lib
</span><span style="color:#323232;">46G     total
</span>

Here we can see /var/lib has a lot of stuff in it, so we can look into that with du /var/lib/* -shc|sort -h - it turns out mine has some big databases in /var/lib/mysql and a bunch of docker stuff in /var/lib/docker, not surprising.

Sometimes you just won’t be able to tally what you’re seeing with what you’re using. Often that might be due to a locked file having been deleted or truncated, but the lock’s still preventing the OS from seeing the recovered space. That generally sorts itself out with various timeouts, but you can try and find it with lsof, or if the machine isn’t doing much, a quick reboot.

digdilem, 1 month ago

Good thinking. That would speed things up on some systems for sure.

digdilem, 1 month ago

I think bus factor would be a lot easier to cope with than a slowly progressing, semi-abandoned project and a White Knight saviour.

In a complete loss of a sole maintainer, then it should be possible to fork and continue a project. That does require a number of things, not least a reliable person who understands the codebase and is willing to undertake it. Then the distros need to approve and change potentially thousands of packages that rely upon the project as a dependency.

Maybe, before a library or any software gets accepted into a distro, that distro does more due diligence to ensure it’s a sustainable project and meets requirements like a solid ownership?

The inherited debt from existing projects would be massive, and perhaps this is largely covered already - I’ve never tried to get a distro to accept my software.

Nothing I’ve seen would completely avoid risk. Blackmail upon an existing developer is not impossible to imagine. Even in this case, perhaps the new developer in xz started with pure intentions and they got personally compromised later? (I don’t seriously think that is the case here though - this feels very much state sponsored and very well planned)

It’s good we’re asking these questions. None of them are new, but the importance is ever increasing.

digdilem, 1 month ago

Fair point.

If the distro team is compromised, then that leaves all their users open too. I’d hope that didn’t happen, but you’re right, it’s possible.

digdilem, 1 month ago

software developers are criticizing Microsoft and GitHub for taking down some of the affected code repositories

Surely it’s sensible of Github to take down malicious code? It’s not just honest, hardworking people trying to make sense of this that have eyes, it’s others looking for inspiration from what appears to be a sophisticated and very dangerous supply chain attack.

digdilem, 1 month ago

One question and some unfollowable advice.

**Question:**Why not use AppArmor? My understanding is that’s what Debian uses by default instead of Selinux which is more native to Enterprise Linux (Fedora, RHEL, Rocky, Alma etc).

**Unfollowable advice:**As an EL admin where it’s the default and very closely integrated, we have a saying; “It’s not always dns, mostly it’s Selinux”. For most distro-sourced software, it’s fine. But if you install software from other sources, you’re going to hit problems.

Others have given good reasons to your specific questions, but one tip if you go down this route. We use a redhat tool, “setroubleshoot-server” which helps hugely in both identifying when something isn’t working because SELinux has blocked it, but also gives you the commands to add an explicit rule to allow it, so you can view the log, understand why it’s blocking, and allow it without needing to get too involved with the complicated file contexts.

Sadly, it looks like this tool isn’t available in Debian, which would seem to make like a lot harder using selinux. Familiar as I am with selinux, I don’t run it on my personal servers or this laptop, which are Debian.

digdilem, 1 month ago

Reading that made me sad, angry and scared. Great article, but terrifying.

digdilem, 1 month ago

Good luck with that.

Commercial and closed source software is no safer, and may even be using the same foss third-party libs under the hood that you’re trying to avoid. Just because foss licences generally require you to disclose you’re using them, it doesn’t mean that’s what actually happens.

And even if, by some miracle, they have a unique codebase - how secure is that? Even if an attacker can’t reach the source, they can still locate exploits and develop successful attacks against it.

At its core, all software relies upon trust. I don’t know the answer to this, and we’ll be here again soon enough.

digdilem, 1 month ago

In what way did I bend your logic? I found your logic quite twisted to start with, and don’t think I did alter it further.

Also - not constructive? But you’re the one that’s being negative. I’m merely trying to point out that you’ll have a very hard job not relying on foss as it stands today. Where we go from here is a much bigger question, but we’ve all got very used to having free software and, as I said, even if we all start paying huge amounts of money for the alternative, that doesn’t mean it’ll be safer. In fact, I rather suspect it’ll be less safe, as issues like this then have a commercial interest in not disclosing security problems. (As evidenced already in numerous commercial security exploits that were known and hidden)