I blow hot air.

  • 4 Posts
  • 22 Comments
Joined 1 year ago
cake
Cake day: July 6th, 2023

help-circle





  • If you’re worried about unauthorized access to the physical machine, you could always just do disk-level encryption instead or store the app’s data in something like a Veracrypt virtual disk. They’d still be able to access the data if they go through your OS/user, but wouldn’t pick anything up by accessing the drive directly.

    Nothing short of E2EE can truly stop someone from accessing your data if they have physical access to the server, but disk encryption would require a targeted attack to break, and no host is wasting their time targeting your meme server. I seriously doubt they’d access it even if you had no encryption at all, since if they get caught doing that they’d get in a heap of legal trouble and lose a ton of business.


  • Podman is purposefully built to rely on systemd for running containers at startup. It ties in with the daemonless and rootless conventions. It’s also nice because systemd is already highly integrated with the rest of the OS, so doing things like making a container start up after a drive is mounted is trivial.

    Podman has a command to generate systemd files for your containers, which you can then use immediately or make some minor tweaks to your liking.

    I use podman for my homelab and enjoy it. I like the extra security and that it relies on standard linux systems like systemd and user permissions. It forces me to learn more about linux and things that apply to more than just podman. You can avoid a lot of trouble by running the containers as root and using network=host, but that takes away security and the fun of learning.


  • From Signal’s blog footnotes:

    Usernames in Signal are protected using a custom Ristretto 25519 hashing algorithm and zero-knowledge proofs. Signal can’t easily see or produce the username if given the phone number of a Signal account. Note that if provided with the plaintext of a username known to be in use, Signal can connect that username to the Signal account that the username is currently associated with. However, once a username has been changed or deleted, it can no longer be associated with a Signal account.





  • Google is disallowing “remote code” in extensions and classifying blocklists (the lists of urls that ad blockers use to know what to block, which are just text files hosted on remote servers like github) as remote code. As a result, any blocklist updates will need to go through the extension review process, which typically takes anywhere from a few hours to a few weeks.

    Google often updates YouTube’s ad delivery on a daily basis. Blocklists must also update as frequently to keep ads blocked on YT. If Google requires that blocklists go through the review process, they can drag their feet and essentially render the ad blockers useless even if they have to allow them to stay in the extension store.