Just your normal everyday casual software dev. Nothing to see here.
I was originally going to add that usually different services can use the same name as long as there’s no overlap, but you can’t even use that on this one because they’re both blogging platforms.
Yeah, unless they have authorization from the original project this is likely going to require a name change.
Said backdoor isn’t possible with the current day key exchange process. Without the servers in use private key, the most law agencies can do without acquiring the private key is force the CA to revoke a cert, which will disallow properly configured clients from accessing and transferring data with the server.
LE doesn’t have enough information to recreate the private key based off the public key, the only key distributed during the CSR process is the servers public key via a certificate signing request which is signed using your private key, which the CA then signs with it’s own intermediate key (which is signed by it’s root server certificate) and hands back to the private server.
The CA doesn’t have the ability to create that private key, and as such doesn’t have a way to decrypt traffic that is using that key. There is no concern for a backdoor in that process.
In order for the “backdoor” to exist, they would need to either copy the private key as part of the signing process (which it doesn’t), or somehow force the server admin to use a new private key (that the CA also holds) or somehow compromise the servers key generation process to allow for an escrow on the private key when it was generated which would allow the CA to be able to recreate the private key using the master & public key.
Now don’t take me wrong, you can still have a MiTM impersonation attack or a full impersonation bypass by the CA issuing a new certificate and having the DNS registrar have the web address go to a new server that is using the new key but, that’s not something the CA alone has the capability of doing, and any traffic that is issued to the original server still wouldn’t be compromised, its just clients visiting your site will end up at the other site and as such will end up using keys that the other side generated instead of your own keys and additionally said new keys would also be appearing in Certificate transparency logs, or modern day clients would refuse to use them.
I don’t think anyone’s going to solve the problem in general, to be honest.
Like, Let’s Encrypts goal is super novel, but also expensive as shit to actually run, and requires a lot of coordination because it needs to be a trust authority. If this ever happened, it would probably be at the backing of some government structure, because I don’t see many people wanting to jump at that as an expense.
Is this accurate? Like, I know what you’re meaning, but I’m pretty sure it’s not ICANN doing it, and more so your domain registrar handing it over to the US government.
I think the most control that ICANN has over it is they could theoretically, if they wanted to, delete an entire top level domain. Since they do control the DNS root, but that is the most that they control from what I understand.
I don’t know if they have the ability to delete or transfer control over an individual domain on legal request. I think that’s outside of what their actual system allows for.
To add some more information to this, you can see the context yourself. (so you don’t need to search like I did) they are referencing a post the Op made from five months ago. Admitting that’s how it worked
I tried to hyperlink it but Anubis gets in the way and throws a not found on the link for some reason, that or the original post was deleted
edit: I finally was able to get it to work. Post is here (not instance agnostic, still not 100% how to do that)
Simply speaking. No
Lets be real, while many do care, it isn’t going to be a “I need to leave the platform” level care.
Furthermore, the people impacted by it, may also not actually be in the majority either. For example they are doing similar to how discord is doing their age verification, where they are using existing metrics to infer your age without hard requiring it. Reddit has stated that said metrics include account age, email provider and topics you navigate.
Unless they have a super heavy handed way of doing this, I doubt anything super meaningful like another mass exodus like how the API issue was will happen.
That is an interesting concept, I would argue that it wouldn’t tackle the root cause of why most would want to federate due to rules just being universally applied to both the user instance and the community instance for the mega instances, and it still wouldn’t do anything with it being against the spirit of the fediverse in terms of needing to spread or web out, but I agree it would be nice.
I tend to agree that the majority of communities are hosted on 3 major instance’s its a concern that makes it difficult remove any of the 3 or 4 mega instances regardless of policies or practices.
I see many saying just boycott or block .world but, a decent source of communities im in are listed there. I know it’s against the spirit of fediverse but I don’t see that changing any time soon.
I use proxmox on one server, but currently my layout is:
LXCS:
VMs:
Also thank you for making this post, it helped me realize I have a few containers and services I don’t use and I don’t think have activity on them anymore so I can start a deprecation cycle on them lol
I use proxmox on one server, but currently my layout is:
LXCS:
Also thank you for making this post, it helped me realize I have a few containers and services I don’t use and I don’t think have activity on them anymore so I can start a deprecation cycle on them lol
As someone who ran Ubuntu server for a few years before moving to Debian. I would recommend Debian over Ubuntu just because I have had to do less maintenance with it. When I was on Ubuntu updating it was a constant concern of “will something change that is bad” for example they pushed the kernel live patch and the Ubuntu subscription banner as an update instead of an upgrade, so I updated as normal, and there it was.
I dislike OS’s that install new packages as part of their update procedures (an update that installs a new package instead of replacing an existing one should be reserved for upgrades), and Debian has never done that with me, so Debian is where I stay.
I noticed this myself by complete coincidence when itjust.works updated and I could click on my own comments and they wouldn’t pull anything.
I had thought that it might have been a bug with the server so I switched over to the standard Lemmy instance and it would load fine.
Then I dug through the settings more and I found the toxic mode hidden in the advanced settings. and realized that when I enabled toxic mode I could see the comment tree.
Weirdly enough, I did a deep dive into all the black lists that it has hard-coded when I saw and I couldn’t for the life of me find out what was flagging that post from being able to be seen. None of the instances of anyone in the comment train were in the black list, I guess it’s possible that the instance itself was in a blacklist, but I forgot to check that.
it’s actually the recommended way if you use jellyfin, theres a few security/privacy vulnerabilities with publicly exposing the jellyfin server anyway, they are being worked on but, the safest way to do it is just use a vpn regardless.
I’m not sure, I was running 2.7.5 myself but i am not sure what version of immich I started with. I didn’t think this would effect fully docker setups much. I think this would mostly effected people who had configured with a preexisting database. I believe the docker edition with postgres built in upgraded for you awhile back unless you supplied an environment variable telling it to do otherwise.
you’re welcome, glad it worked for your use case.
Rsync is an insane tool when you look at it, half the flags you wouldn’t even know existed unless you were looking for them.
hey everyone gotta learns somewhere, and defo don’t expect you’ll ever stop learning on this adventure. That’s part of what makes this hobby fun!
is there any reason in particular that you are using both SSHFS and rsync? Rsync supports sftp which runs over an ssh connection via rsync -e ssh source dstUser@dstHost:/path
if you are only using the sshfs system to allow a local ssh directory on your system to use with rsync, you could likely skip that entire part and just use rsync.
LinuxConfig.org has a pretty decent page on it
As an FYI to people who are upgrading and use a preexisting postgres database If you still use pgvecto.rs (if the command \dx on the immich database responds with vectors not vector) you will need to install both pgvector and vectorchord in order to continue using immich. This will require restarting your postgres instance at least once if not twice.
It threw me for a loop at first because of the similar naming. Just thought I would share.
Yea hopefully. I know that short lived certs is currently an additional parameter when requesting, hopefully when the default changes they will have a higher rate limit. That won’t be for quite some time though I expect.
zabbix with ntfy for short term alerts and a telegram bot for long-term alerts.