Are your exposed services all on their own ports externally, or behind a reverse proxy?

Putting them behind a reverse proxy makes sure that attackers at least need to know the correct hostname to access your service.

This is security by obscurity which isn’t proper security but it means that all of the port scanners out there likely won’t know your jellyfin server exists when a vulnerability for jellyfin is released.

If you use let’s encrypt or something similar be aware that all issues certs show up in a public log so attackers like to harvest that log as a list of valid domain names. Switch those certs to wildcards so that you aren’t advertising those valid hostnames.

There are often options in reverse proxies, or sometimes your router to do geo based blocking. If you can limit connections to your local country only you eliminate huge portions of the botnets out there.

Combining this with auto updates/reboots on your services is probably enough to keep you safe, but if you want to really secure things a separate DMZ vlan for your services to prevent an attacker from compromising additional services on your LAN.

The more network segmentation you can do the better. An ideal setup is every app/container in its own network/ACL that only allows traffic to the specific network devices that it needs to talk to. This is a lot to manage if you do this with your router/vlans. Containers orchestrators (i.e. k8s) make this easier, but don’t protect you from kernel level exploits to break out of the containers. I believe proxmox has VM level ACLs now so you could skip the vlans and do your segmentation at that level instead.

I hate this take, and it seems to contradict itself.

What actually counts A copy counts when it survives the loss of the thing it was copied from. That one sentence settles most arguments about what is and isn’t a backup.

So doesn’t raid count then? If a drive fails and the second drive survives the loss, it is a backup…

Just because the copy is synchronous doesn’t mean it isn’t a backup, it just means it protects from a different type of failure.

• RAID: protects against a drive failure
• Snapshot: protects against user failure (rm *)
• Replication: protects against admin failure (zpool destroy)
• Offsite tape/async backup: protects against replication corruption, and total site failure

These are all backups, just with different recovery point objectives/recovery time objectives, and all just as important.

It certainly isn’t good to depend on it but security by obscurity is your first and probably most important line of defense. When these vulnerabilities come out they need to know your service exists to exploit it.

The best way to do that is to setup a reverse proxy to reject invalid hostnames. A single port is all you need exposed for multiple web services, and the IP scans won’t find the script kiddies anything valuable. Be careful with lets encrypt, there is a public journal of all issued certs, so make sure to get yourself a wildcard cert so that you aren’t advertising your valid hostnames to the world.

Use the reverse proxy to put basic auth in front of your services (if they can handle that). Basic auth is very simple, no web forms to attack, just a single header. If your php site is vulnerable they won’t ever be able to even attempt to reach it without a valid username/password.

I’ve got a mix of containers and VMs behind that reverse proxy. The containers have network security groups around them limiting network access. The VMs are in a Harvester hypervisor with KubeOVN for software defined networking. That means each VM is in its own subnet with network security groups around the subnet preventing any unnecessary network access.

For machines/containers that need Internet access I have a Squid proxy with an explicit whitelist of allowed URLs so that the machines can’t reach out to unauthorized sites to download their malware or contact command and control nodes.

Unattended updates for the VMs, and FluxCD keeping helm charts up to date hourly for the containers. For my own containers, weekly scheduled container rebuilds.

I do have one public website that I host for a friend (indexed by search engines so the sites name is known to the world). My friend had originally deployed that as a WordPress site, but WordPress/PHP don’t have the best security track record so I was concerned about that. The site was pretty simple so I recreated it as 100% static content, so now the attack surface is just a nginx container with a read-only filesystem.

Wireless display is too laggy? Steam Link is how half of the people using the frame are playing games in the first place. Not having the dongle doing the transmitting might add a couple of ms of delay due to the second hop, but there are many people who have been gaming with steam link for years.

I’ve bought about 16 drives from goharddrive (through eBay). Most of them 5+ years ago without any failures. So I can’t say how well they honor their warranty, but they have been around for some time so that is probably a good sign.

If you are running your power supply near its limit I have seen that cause drive drops as well. If you continue to see drives drop that seem to be functional and cables/HBA don’t seem to be the cause, you might want to swap/upgrade power supplies if you can.

I assume it is fake, but basically these US companies spent billions making proprietary models to make money and the Chinese came along and made models that are just as/nearly as good, and made them open for anyone to use.

They are also charging less to use them. Third parties that provide AI access can run them on their own hardware without expensive licensing fees so again they are some of the cheapest models to run for their capabilities.

The US companies thought it was a race to the top. First one to hit AGI would get mega rich eliminating jobs across the globe. Turns out AGI isn’t here yet, and it costs so much to run that no one is paying for it anyways.

The Chinese know this is a race to the bottom. The models will get better, and the hardware more capable, so focusing on compute capacity and keeping costs low is the important part.

If the Chinese keep up, or at least nearly keep up with a considerably lower cost, then the US AI companies can’t make their money back (they aren’t anywhere near profitable) and go broke.

“We put our AI in a sandbox that doesn’t really sandbox, and asked it to hack some stuff. Who would have thought it would go and hack stuff? The AI totally went rogue doing exactly what we asked it to do.”

Whoops, did they pull the rug at the wrong time and the wrong investors lost out? Or is this just to save face?

Who is dumb enough to be investing in new crypto coins at this point?

“Scam” was certainly hyperbole, I just exaggerated it to drive home the point. The casino bit could have been worded better too. Playing the game or collecting cards when you know what you are buying is not gambling, it is opening packs that’s like going to the casino.

Paying for a pack that you have no idea what the contents are hoping for a big card is no different than putting money down on a hand of blackjack and hoping for a payout. The game or the collecting is just what we use to justify the gambling as buying something with real world utility.

I don’t exactly have a problem with the business strategy (other than targeting kids), go ahead and gamble, and I can’t claim to be above participating. It’s just that the players need to be aware of what is happening and that our brains are a lot more easily manipulated than we think we are. Entertainment value with a drip feed of dopamine hits is pretty powerful.

Because free speech is still a thing. They would need to find evidence that he had/distributed csam content, or had actually molested someone.

Best we can hope for is that they started an investigation and will manage to link something to him, but an adult talking to other adults isn’t illegal so they aren’t going to arrest him on the spot in the airport.

If they are working on an investigation they won’t actually arrest him until they think they have enough concrete evidence to actually win a case, and that is usually weeks/months later.

It is as much a scam as the cards themselves. Artificial scarcity designed to addict our brains to gambling.

The grading feeds on/into the main scam of the cards themselves. The whole cycle requires that we place “value” on their slabs of paper and grading helps make that value more concrete in your brain. The more value you see in the cards the more of them that you want to buy. More cards sold means more grading, so the cycle goes round.

Have fun playing the game, just be aware the whole thing is no different than going to the casino. They just hope the psychological effect of not gambling with money addicts extra people who wouldn’t normally gamble with money (i.e. children or those morally opposed to gambling)… and the house always wins.

This would be more of a use case for blockchain, any site(/user) wishing to mirror the social media would participate in the chain. A post on one site would get pushed into the chain and show up on every mirror.

Media would likely have to be links outside of the blockchain since it isn’t usually very good at storing large datasets (it would make it difficult to mirror over time as it grew), so if you wanted a full mirror you would probably have your site fetching media as soon as it is posted and mirroring it yourself.

Or media might be a good spot to integrate with your bittorrent idea. Blockchain handles the distributed state of the site (communities/post text+metadata), and any submitted media is added to the post as bittorrent hashes. I don’t know how scalable bittorrent clients are though it might take considerable overhead to seed millions of pictures/videos.

https://www.linuxatemyram.com/

This is normal. Linux caches disk reads so that you don’t have to go to her/SSD to reread blocks. If your app isn’t using the ram Linux will use it instead.

Zero reason to be concerned, because if your app allocates more memory Linux will evict the cached pages to make sure your apps have plenty of space.

In this case your apps have memory that isn’t being touched (sometimes a sign of a memory leak), and Linux has decided that caching your disk access is more advantageous than keeping the unused application memory in ram.

If you have apps that you don’t use often and are really slow to access when you finally do, keep lowering that swappiness value or just remove swap all together if it annoys you.

Looking at your graph you have a lot of ram that you don’t really need… I would just disable swap entirely. Otherwise you are just wasting write cycles on your SSD.

License plate reader just means it is a higher class of camera with a good enough sensitivity+extremely low exposure time to read license plates (license plates are really hard to read especially in the dark due to their reflectivity+the speed of the cars).

So it doesn’t mean they are only for license plates, it means it is a higher class of camera than your standard cctv camera.

Them’s fighting words! ;) yyyy-mm-dd is superior in every way. Sorts properly and much less potential for confusion across cultures.

Best case scenario is that it uses an esp32 microcontroller. If so you can use esphome (https://esphome.io/) to easily make your own firmware that you can then control from web/API/homeassistant with no external cloud/app requirements.

There has been some work to include other microcontrollers (NRF/Raspberry Pi pico/etc), and some third party repos that add some support for some realtek chips.

If you are getting a portable air conditioner get one of them that has dual hoses. The single hose units are practically a scam.

The single hose units take cool air from inside, warms up that air, and then blows it outside. This does make cold air inside the house, but you are using your already cooled room air to do the heat transfer and blowing that outside. This also means you are creating a vacuum in your house which pulls in more hot air from outside.

The dual hose units pull in warm air from outside in the first hose, heats it up further, and then blows it back outside out the second hose. No negative pressure in the house, and you aren’t using air that you have been paying to cool all day to do the heat transfer.

these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks.

Sounds like a feature

If you click the link button it opens up the video instead of the preview jpg.

E=mc^2

Energy and mass are just different measures of the same thing. The transporters job is to take mass and turn it into something that it can more easily move around (a wave? Particle stream?) and back. So as long as the transporter is connected to the ship’s energy supply it should theoretically be able to use that energy (instead of the energy from your body) to reassemble any pattern it wants without breaking the law of conservation of mass.

Riker is 6’4 let’s say 200lbs, which is 8,153,369 terajoules.

DATA: Imagination is not necessary. The scale is readily quantifiable. We are presently generating twelve point seven five billion gigawatts per (an alarm goes off)

One watt is one Joule per second, there is some debate out there about the “per” part of the quote since watts already implies per second, but we probably assume the ship is capable of generating 12,750,000 terawatts, or 12,750,000 terajoules per second.

8,153,369/12,750,000 gets us about 0.64 seconds of the ships output to create our duplicate Riker.

However the quote above was when the ship was basically idling, (not actually at warp) so the actual output of the ship is likely exponentially larger.

Basically they have so much power available, that they can just rearrange it into whatever mass they want.