321–330 of 347 posts
Earlier quoted context omitted.
Remote server's a 20USD/month DigitalOcean droplet with 4GB memory. Though even half of that would also have specified for these services. Home server's a Raspberry Pi 4.
Prefab system images From Russia With Love, including password managers and surfing proxies, spun up on a VPS operated by totally unknown people (probably remoted to the actual DC from some place with bad water)...security nightmare. When I see Statue of Liberty sticking up out of the water on the shoreline, imma scream like Charles Heston! Need Congress/FTC to set guidelines. In mean time, know that you don't get al…
Unifi controller
Miniflux
CouchPotato
DSMR Reader (software that logs smart electricity meter data)
Gitea
Deluge
MySQL
PostgreSQL
Cloud Storage mirror (for Google Drive backup)
Full Bitcoin node
Bitcoin lightning node
Trading Software
Various PHP websitesEarlier quoted context omitted.
Have you taken a look at podman / buildah? My understanding is that podman resolves all of the security concerns you highlight above while mostly maintaining compatability with the docker cli and existing docker images. It gets rid of the docker daemon so your containers (and restart policy) can just be managed by your existing service manager. I only just recently discovered podman and I've been pretty excited. Havi…
I'm a little bit too familiar with podman. LXD is more mature and actually implements all of the hardening features I mentioned. podman could implement them in theory, but doesn't. Its default security posture is very similar (though not the same as) Docker. Don't get me wrong, I do want to see podman succeed -- but I don't like the amount of unneeded hype around it. It's effectively a Docker rewrite by Red Hat (and…
You've definitely convinced me to take a good look at LXC/LXD though. Thanks for the thorough response!
Earlier quoted context omitted.
I'm a little bit too familiar with podman. LXD is more mature and actually implements all of the hardening features I mentioned. podman could implement them in theory, but doesn't. Its default security posture is very similar (though not the same as) Docker. Don't get me wrong, I do want to see podman succeed -- but I don't like the amount of unneeded hype around it. It's effectively a Docker rewrite by Red Hat (and…
I have to admit, the biggest selling point to me for podman is the removal of the central docker daemon. For my use case (personal workstation and home lab), it seems strange to me that I need essentially another service manager for these processes just because I want to slap them in a container. It definitely makes sense that there would still be some gaps though as it's a less mature product. You've definitely conv…
You can use LXC directly if you want to avoid a long-running daemon.
Earlier quoted context omitted.
US copyright laws have been proliferated around the world. Copyright was originally intended to be a limited-time monopoly which allowed consumers the ability to trust creators and creators the ability to share without worry that their idea would be stolen by other businesses . It was never intended to limit the rights of consumers, it's been warped into that by Disney which rewrote the laws to protect Mickey. Copyri…
>ability to share without worry that their idea would be stolen by other businesses. Presumably so because consumers stealing the final products was already prohibited / a crime. The final product was generally physical, and consumers would have to physically break into stores to get their copy of whatever was produced and it was already illegal. And even if the consumers obtained their copy by legitimate means, them…
https://www.smithsonianmag.com/arts-culture/first-time-20-ye...
Earlier quoted context omitted.
Have you considered moving from tinc to Wireguard?
I use both, and one thing I found that is sucky about WG is that it does not work well with the Windows firewall. I need to give full permission to an app to be able to access ip addresses routed by WG. Tinc does not have this problem.
One thing I noticed with tinc is that it does not take advantage of sysctl network tuning. I had to increase the network buffers for that dynamic routing to not make as much of a noticeable slowdown.
Cipher = aes-128-cbc
ClampMSS = yes
UDPRcvBuf = 81920000
UDPSndBuf = 81920000
Compression = 0Earlier quoted context omitted.
I see you're using Bitwarden. Does anyone have recommendations for password+sensitive-data management? I'm currently using Keepass and git, but I have one big qualm. You cannot choose to not version-control that one big encrypted (un-diff-able) file.
You might like Pass [0] or GoPass [1] which had more features the last I looked at it. They both store passwords/data in gpg-encrypted files in a git repo. I'm not sure what the state of GUIs/browser plugins are for it, but I'm pretty sure there are some out there. You can also set up your git config to be able to diff encrypted .gpg files so that the files are diff-able even though they're encrypted. [0]: https://ww…
“Self-host” is such a weird word. Having your own stuff yourself should be the default , should it not? I mean, you don’t “self-drive” your car, nor “self-work” your job. The corresponding words instead exists for the opposites: You can have a chauffeur and you can outsource your job. I think the problem is entirely caused by the US having absolutely abysmal private internet speeds and capacity. Since you can’t then…
Saudi is like this, I hear, Jakarta too. I assume there's more.
Earlier quoted context omitted.
Not to mention a fourth kind of person - one who just wants services that work better than what the cloud offers. By definition, self-hosting means the service is under my control, doing what I need, customized for my use cases. And because I use only open source stacks, I can (and have) even modify the code to customize even further. And that's ignoring the fact that free, self-hosted options can often provide featu…
Could you elaborate on how you got TTRSS to scrape?
https://github.com/HenryQW/mercury_fulltext
The directions there are pretty clear. You've gotta set up the mercury parser API service (I used docker) and then enable the plugin for the feeds you want to apply it to.
Alternatively you could use the Readability plugin that ships with tt-rss, but I have no idea how effective it is as I never tried it.
Finally, you could stand up the RSS full text proxy:
https://github.com/Kombustor/rss-fulltext-proxy
That service standa between your RSS feed reader of choice and the RSS feed supplier and does the scraping and embedding.