• 0 Posts
  • 64 Comments
Joined 1 year ago
cake
Cake day: June 19th, 2023

help-circle




  • Docker Swarm encryption doesn’t work for your use case. The documentation says that the secret is stored encrypted but can be decrypted by the swarm manager nodes and nodes running services that use the service, which both apply to your single node. If you’re not having to unlock Docker Compose on startup, that means that the encrypted value and the decryption key live next to each other on the same computer and anyone who has access to the encrypted secrets can also decrypt them.



  • The Index by itself is 500 dollars, not 1k.

    LCD screen was a feature of the Index over the OLED screen in the Vive. On the Vive, the OLED has a visible pattern and some of the image is lost because there aren’t an even number of red green and blue subpixels (similar to PSVR2). The Beyond is screen is micro OLED with a more regular subpixel pattern.

    PSVR might be the only headset available with these features for cheaper, but not much cheaper, and it doesn’t have the headphones.


  • Be careful with doing this. X-Real-IP and X-Forwarded-For are good for when the client is a trusted proxy, but can be easily faked if you don’t whitelist who’s allowed to use those headers. Somebody with IPv6 access could send “X-Real-IP: 127.0.0.1” or something and if the server believes it then you’ll see 127.0.0.1 in logs and depending on what you’re running the user may gain special permissions.

    Also be careful with the opposite problem. If your server doesn’t trust the proxy, it will show the VPS IP in logs, and if you’re running something like fail2ban you’ll end up blocking your VPS and then nobody will be able to connect over IPv4.



  • There’s a lot of wrong advice about this subject on this post. Forgejo, and any other Git forge server, have a completely different security model than regular SSH. All authenticated users run with the same PID and are restricted to accessing Git commands. It uses the secure shell protocol but it is not a shell. The threat model is different. Anybody can sign up for a GitHub or Codeberg account and they will be granted SSH access, but that access only allows them to push and pull Git data according to their account permissions.







  • Are people in this article really suggesting that the 100% emoji is racist? You can never get a perfect score or agree with anything again because a small number of people have used that number to mean something else and now somebody will interpret it as a hate crime.

    At first they were arguing that somebody writing “shit” in an exaggerated way, and the occurrence of two other numbers and an elongated asterisk were Nazi symbols, and they could be, but the only evidence is that somebody said they thought it was too many coincidences. I don’t know enough about the circumstances to say it is or isn’t intended that way. Management apparently thinks it isn’t. But saying multiple people reacting “100%” to a message they agree with means they’re all using the number 100 as a sign of white supremacist solidarity is ridiculous. What else are they going to do? React with the “OK” hand? No, the ADL also decided that one is racist. React with thumbs up? No, younger people have decided that one is rude.


  • Don’t laptops with batteries use slightly more energy than equivalent PCs? The battery will drain because it loses charge over time or because the laptop is designed to draw power from the battery during normal operation, and then energy is lost when recharging the battery because battery charging is not 100% efficient.

    I don’t know how searxng works, but if it’s making many requests and aggregating the results, you will probably get much worse performance running it on your phone, even if the phone is with you. Instead of making one request over a bad cell connection, you would be making many requests over a bad cell connection.




  • My favorite is when IT deploys software that replaces all the links in your e-mails with https://example.com/phishing/YiCdMdsY so you can’t tell whether the e-mail is phishing or not, frequently sends you very obvious fake phishing e-mails that interrupt your work by going straight to your priority inbox, and punishes anyone caught clicking on phishing e-mails. Then HR sends out e-mails that have all the indicators of low effort phishing and you’re supposed to click on those.