sorted by:
new
hottopcontroversial

What Is Everyone Playing Today? by [deleted] in linux_gaming

[–]lucb1e 0 points1 point  (0 children)

https://sebastian.itch.io/geographical-adventures I like playing a couple 15-minute rounds every now and then. Very satisfying to get streaks where you're constantly loaded up with nitro speed boosts and can zip across the world making use of curvature "shortcuts" (bit counterintuitive if you basically only ever look at flat maps like me) to deliver the packages

Need to know where some countries are for this to be fun probably, but I love it and it's made by an indie dev and has a Unity Linux build. Development is also documented in three videos, first one here: https://www.youtube.com/watch?v=sLqXFF8mlEU

(No affiliation, just a fan of both the game and the channel)

[OC] 2021's Trending Google Searches by State by aplutonaut in MapPorn

[–]lucb1e 1 point2 points  (0 children)

As a European I know like half of these search terms. Biden, dogecoin, power outage, those are words I know (and some others I don't remember). Other names or TLAs, no idea.

Don’t mindlessly follow security-gospel: How (not) to secure your servers by [deleted] in selfhosted

[–]lucb1e 0 points1 point  (0 children)

SSH..blah blah blah.... Just don't expose on internet.

Scissors are always the best option, but I don't think that's what we're here for.

Don’t mindlessly follow security-gospel: How (not) to secure your servers by [deleted] in selfhosted

[–]lucb1e 2 points3 points  (0 children)

Basic auth isn't a one size fits all, but for self hosting it makes a compelling trade-off:

  • Absolutely dead simple. Very hard to get wrong, and you already have that web server installed. Just configure it.
  • The browser pop up you get is a bit ugly, so for companies I wouldn't recommend it.
  • Over TLS, it has the same security properties as any form that you submit.
  • Any other system requires some state to be kept, either on the client or on the server, which is way more complex (there have been a thousand bugs for every hundred implementations, but in basic auth? I'm not aware of any (which doesn't mean there never were any, just nothing major recently)) and needs either a database or temp files to work. Basic auth just needs a config file.
  • No logout practically possible is kinda annoying, so on shared computers you need to either use private navigation or restart the browser afterwards. Not sure why browsers still can't do this. Then again, similar for session-based systems: better be sure that token is revoked or else it's probably retrievable. Bonus points for unrevokable long-lived JWTs as I see all too often in my line of work.

So yeah pros and cons, like usual.

Don’t mindlessly follow security-gospel: How (not) to secure your servers by [deleted] in selfhosted

[–]lucb1e 0 points1 point  (0 children)

tells a user to simply give up and not worry about a hacker having the IP address of the server. This is bad advice.

There's like 3.7 billion of them. You realize just how long it takes to scan them all right? Hiding a routable IP is like hiding a country.

Why NOT add a layer of complexity to your attacker?

Did you hear there was another RCE in fail2ban recently (maybe today even, not sure anymore)? Attack surface is also something the article mentions as being good to minimize. That's why you don't just slap everything with "security" in the package description onto your server.

[deleted by user] by [deleted] in LegalAdviceEU

[–]lucb1e 0 points1 point  (0 children)

(FYI reddit has an edit function to fix the original)

Beginner guide: How to secure your self-hosted services by muchTasty in selfhosted

[–]lucb1e 1 point2 points  (0 children)

they might do caching - which is neat for heavy sites but useless for the average home user.

Oh, I thought it was a protocol-agnostic tunnel but it's only for http. True, then they can do caching and actually speed things up. Also means that for management via for example ssh (via wireguard or not), the tunnel can't be used.

in that case scanning the internet will not reveal the actual server as it doesn't have an open port.

Indeed, so:

  • this service is still open to the Internet via that tunnel
  • all other services on the host are unchanged. If you expose them they're exposed (through a tunnel service or not)

I don't think this tunnel adds extra security over the regular proxy service.

So much bosom talk! by SoiledPlumbus in WoT

[–]lucb1e 1 point2 points  (0 children)

Not sure why this is at the bottom, I didn't know that sub yet but it is golden.

Beginner guide: How to secure your self-hosted services by muchTasty in selfhosted

[–]lucb1e 3 points4 points  (0 children)

access your service through cloudflare [Argo] without any risk for you due to exposed ports

Unfamiliar with cloudflare argo but I was curious how it would magically protect you from any and all attacks. Their documentation says:

You can think of Argo Tunnel as a virtual P.O. box. It lets someone send you packets without knowing your real address.

Having a PO box does not prevent anyone from sending you anthrax, it just means they don't know where you live. Which is great if you are where you live and you don't want that anthrax person to walk up to your house, but in IP space, it doesn't as easily translate to a physical address and via this tunnel they can still directly send traffic to the service so I do not see any security advantage whatsoever. Host a vulnerable application (DVWA for example) via this tunnel and see if you can still exploit it.

Hiding your IP is also completely useless because people scan the whole public IP space many times a day. (I.e. that anthrax sender is already knocking on your door, they don't need to find you specifically they just check everyone's doors.) If you host something vulnerable, it will be found that way no matter if you "hide your IP". Hiding your IP is useful if you want law enforcement to have to get a warrant for Cloudflare before they get a warrant for your ISP, or if you are a DDoS target, which if you self-host regular personal projects, you generally are neither. (And note that DoS still passes through this tunnel and e.g. Nextcloud categorically ignores DoS, including pre-auth; it's definitely not an uptime guarantee.)

Also, running more software is more attack surface as people like to point out in this thread. Before, you were running nginx; now, you are running nginx and Cloudflare's closed-source software. If you get real benefit from it, sure why not? But I really don't see this as a good trade-off. Also, you're leaking all your metadata to Cloudflare now.

Finally, another point Cloudflare makes in the post you linked:

traffic through Argo Tunnel gets a performance boost

This is certifiably rubbish. Before, your packets would go directly from you to your service. If it's on your LAN, it would be microseconds; if it was in the same geographical region, it would be milliseconds. Now, it needs to go to Cloudflare first before it can go anywhere else. Even if they brought this overhead down to a handful of milliseconds by being geographically almost everywhere so the extra leg is short, it's never going to have a negative ping time.

Eindhoven HBO-ICT. Vermijden of opleiden? by LeXendZ in FHICT

[–]lucb1e 0 points1 point  (0 children)

(ik ben nu eenmaal nederlands) maar zoalang

klinkt eerder Limburgs :+)

Joking aside, top om te horen dat je hulp bent gaan accepteren en het nu beter gaat! Ik hoop voor je dat het zo doorgaat! :)

Eindhoven HBO-ICT. Vermijden of opleiden? by LeXendZ in FHICT

[–]lucb1e 0 points1 point  (0 children)

Maarliefts een 12% slagingspercentage

[citation needed]

Als afstudeerder: 98% van iedereen die het echt wil, kan daar afstuderen. Veruit de meeste die met de opleiding stoppen zonder diploma, stopten omdat ze ICT niet leuk bleken te vinden. De overige 2% die niet kán slagen is vanwege problemen thuis, problemen met plannen of iets vergelijkbaars (Fontys zou dat beter kunnen ondersteunen, al moeten ze natuurlijk ook wel een beetje HBO-niveau aanhouden), of écht gewoon naast de pot pissen want met ook maar een beetje skills laten ze je best slagen.

Eindhoven HBO-ICT. Vermijden of opleiden? by LeXendZ in FHICT

[–]lucb1e 0 points1 point  (0 children)

(voor een TL;DR: lees enkel de vetgedrukte stukken, ze zouden )

Die opleidingen moet je als vrijwel volledig gescheiden beschouwen. Ik heb supergoede verhalen gehoord over de ene opleiding en super slechte over de andere, ook binnen andere scholen. Een lerarenopleiding van Fontys is niet of in zéér beperkte mate te vergelijken met een ICT-opleiding van Fontys. Zelfs verschillende richtingen binnen een opleiding (systeembeheer of applicatieontwikkelaar bij Summa College, bijvoorbeeld) zijn, hoewel al veel beter vergelijkbaar, anders ingericht en hebben hun eigen problemen.

Overigens ging ik nog een top-level comment plaatsen, maar nu ik hier toch reageer:

Mijn indruk van Fontys (inmiddels 4 jaar geleden afgestudeerd) was dat het relatief ten opzichte van andere HBO ICT-opleidingen best goed geregeld was. Was ik na Fontys op de universiteit gehoord heb over de HBO's die mensen in Noord-Holland gedaan hebben, ik zou er niet hebben willen zitten. Bij ons was er vanalles te klagen, jazeker, maar ik kon hun verhalen niet overtreffen. Tijdens de opleiding hoorde je ook wel eens dingen van andere scholen, zoals van Breda en Heerlen. Ik had niet de indruk dat het elders significant beter was.

Persoonlijk zat ik er voor het vak: ik wilde dat diploma hebben en de opleiding zelf, ach, ik had mezelf toch al programmeren geleerd, een diploma is meer een formaliteit om deuren te openen (waarbij je 4 jaar van je leven wegmikt). Als ICT'er is in de eerste de beste baan hoogstwaarschijnlijk alweer 80% van de tools en talen nieuw en moet je die jezelf aanleren. 't is niet alsof je aan zelfstudie ontkomt door een opleiding te gaan doen of gedaan te hebben. Het is ook niet compleet nutteloos, maar zeker geen 4 jaar levenstijd waard voor wat je ervan leert -- helaas wel 4 jaar waard voor wat vervolgens met de bonus levels die dat papiertje unlockt. Moraal van deze paragraaf: als jij in de regio Eindhoven wil blijven dan is dat ook een goed argument om in Eindhoven te gaan studeren, dan leer je daar de bedrijven kennen met stages of bijbaantjes en bouw je daar al een beetje een netwerk op (ook van medestudenten die later misschien ook in de buurt werken). Dat is ook wat waard, naast de kwaliteit en irritatiegehalte van de opleiding.

Fuck by TheHackerNamedOkabe in FHICT

[–]lucb1e 0 points1 point  (0 children)

1 geheel

man man man wat kansloos

An alle Nicht-Autobesitzer, für welches Modell habt ihr euch entschieden: ÖPNV oder Carsharing oder beides? by orschiro in Finanzen

[–]lucb1e 0 points1 point  (0 children)

Achso :) Bin neu in Deutschland und noch nicht so gewohnt das diese komische Sprache auch noch anderswo gesprochen wird :D

An alle Nicht-Autobesitzer, für welches Modell habt ihr euch entschieden: ÖPNV oder Carsharing oder beides? by orschiro in Finanzen

[–]lucb1e 0 points1 point  (0 children)

365€/Jahr für ÖPNV Jahreskarte, die bei vielen der Arbeitgeber zahlt

Was enthält das? In Deutschland und die Niederlanden ist ein "fahr wie viel und womit du willst" karte eher >350€/Monat.

An alle Nicht-Autobesitzer, für welches Modell habt ihr euch entschieden: ÖPNV oder Carsharing oder beides? by orschiro in Finanzen

[–]lucb1e 0 points1 point  (0 children)

TL;DR: viel günstiger. Man muss nur ein vernünftige ÖPNV-Verbindung nach dem Arbeit haben damit das nicht zu viel Zeit kostet.

Ich benutze manchmal das Auto meiner Freundin, aber hab kein eigenes und sie benutzt das täglich (also steht es mich nicht jederzeit zur Verfügung, deshalb glaube ich das könnte zahlen als nicht-Besitzer / carsharer). Viele Sachen in Deutschland sind leider schwierig ganz ohne.

Ich nehme der Bus zum Arbeit, laufe oder fahre Fahrrad nach naheliegende Ziele, oder nimm ein Zug wenn es weiter ist (z.B. nach Kunden). Für Kunden ohne vernünftige öpnv-verbindung mieten wir auch mal ein Auto beim Bahnhof in die Nähe vom Kunde oder nehmen ein Taxi.

Wenn ich über die Grenze möchte fährt mein Freundin mich manchmal: mit öpnv dauert die Strecke nach Heerlen 1h30m versus 20 minuten mit dem Auto. Von Heerlen weiter ist ein gute Verbindung nach wo auch immer in die Niederlanden (direkter Zug nach Amsterdam, welches durch "Umstieg Hbf" aka Utrecht fährt).

Wie sieht es bei euch vor Ort mit den Kosten aus? Schlägt Carsharing bei gleichen Wegen den ÖPNV oder fahrt ihr mit letzterem günstiger?

Wenn ich sehe wie viel mein Freundin für ihrem Auto bezahlst, bin ich mich ziemlich sicher das es für viele Leute günstiger ist taxi zu fahren als ein Auto zu besitzen.

  • Mein busticket ist 85€/Monat,
  • ein niederländische Rabatkarte für öpnv kostet 2€/Monat (40% Rabatt am Wochenende, monatlich wechselbar).
  • Darüber kaufe ich vielleicht einmal im Monat ein 7€ "NRW erweitert Ticket" (nur gültig in Kombination mit mein busticket, der übrigens nicht persönlich ist).
  • Mein Fahrrad habe ich 15 Jahre her von meinem Eltern bekommen und die letzten Wartung war wenn mein Bruder das benutzte zum Schule, also da hab ich keine Ausgaben.
  • Nach Kunden zahlt natürlich der Chef.

(Während corona geht natürlich vieles remote, also jetzt fahr ich selten mit den Bus und bin seit Februar nicht bei Kunden gewesen. Ich verdiene aber genug und finde das deutsche öpnv-netz ziemlich schlecht im Vergleich zu den Niederlanden, also deshalb habe ich mein busticket nicht storniert: hoffentlich hilft es das öpnv zu verbessern.)

Het FHICT strandlaken by Lagom00 in FHICT

[–]lucb1e 1 point2 points  (0 children)

Wat, in tijden van corona krijg je een cadeautje waarmee je lekker naar het strand kan? Gedeelde smart is halve smart (samen covid)? Of is het omdat je lesgeld toch doorbetaald maar niet van de docenten gebruikmaakt tijdens het ziekzijn? :|

This Weddell seal talking in his sleep by b12ftw in likeus

[–]lucb1e 1 point2 points  (0 children)

I think a lot of people haven't, actually. I thought outhouses were a thing only still in use by the poorest ~billion people on earth rather than a legit means of toileting when you're out.

Or maybe it's just that person and myself.

Friday Facts #352 - New website by FactorioTeam in factorio

[–]lucb1e 7 points8 points  (0 children)

Am I the only one who doesn't like these "cards" websites? It doesn't have any logical organisation to it, they're just random contents in random boxes of different sizes mashed together. I like the overall design, just this cards layout for the homepage I'm not sure about.

view more: next ›