The idea that centralized social media should serve as an emergency broadcasting system is....a bad one. It's only guarantee is that ads are to be served alongside propaganda.

"Over 50 per cent of heroin addicts will stop using by 2025 as negative, obvious consequences grow"

Pretty much anything that takes followers away from the church is likely to be labeled evil.

I just joined and I suspect that you're correct: there's an overall learning curve. No snarky tone intended, but explaining decentralization to those who would likely struggle with grasping the basic client/server model is going to be challenge.

Shoot, I've got 10 years pentesting and R&D under my belt and it took me a while to weigh the pros and cons of creating an account on a public instance or self-hosting. (Will self-host eventually...enjoying a test drive.)

Is this like door dash for saddies?

I'm a climate idiot. Does this somehow relate to ice ages, I wonder?

My mistake.

A few of mine that I use daily...

Networky Things:

• Caddy
• Tailscale
• Headscale
• Go Simple Tunnel (GoST)

A couple of personal projects:

• Skyhook (Data exfiltration server)
• Eavesarp

this sort of stuff is rampant. A few years old but it makes my blood boil every time I think about it.

Tool Creator should work on this, it ain't making no sense that the default json file (Google) is not updated cause seeing that work on Google tells us that it definitely works on all sites

@drk1wi please resolve google.json file to stop this cookie disabled error

Seems minor but the tone of the demand is wildly entitled.

Probably a poor decision to be creating accounts on government operated instances. Since they own the server, they're in a position to:

1. Siphon credentials and attempt reuse to gain access to distinct services

2. Ban individual accounts

3. Censor based on post content

I'm all for government support and adoption of open-source software so long as they're not in the position to disrupt how it's used by the public at large.

Edit (my perspective is relevant, but doesn't apply in this case): My nerd impulses outran my willingness to read the link's content. Seems it's not for public registration.

Edit 2: Like my cornbread eating American ass can read Dutch anyway 🤣

Yikes! I'd avoid leaving any services externally exposed unless they're absolutely necessary..

Tailscale+Headscale are pretty easy to implement these days. Since it's effectively zero trust, the tunnels become the encrypted channel so there's an argument that HTTPS isn't really required unless some endpoints won't be accessing services over the Tailnet. SmallStep and Caddy can be used to automatically manage certs if it's needed though.

You can even configure a PiHole (or derivative) to be your DNS server on the VPN, giving you ad blocking on the go.

How about we all stop paying taxes until the fucks start using the income for things other than making foreign peoples dead?

There's enough money in the pot, it's just squandered on things that don't benefit the people. We could accomplish so fucking much with just the amount of cash that the Pentagon misplaces every year.

I'll never understand the obsession with demanding more from the rich while we can't even account for what we already have. Is everything a goddamn distraction campaign?

/rant

Definitely complicated to root cause. Please share if ya figure out the hard parts 😄

An idea: Netflix could be fingerprinting TUN interfaces on the TV.

One thing I'd consider trying is Tailscale in userspace networking mode on a distinct network host at location 2, which'll start a SOCKS/HTTP proxy that the TV can use for outbound connections.

Bonus: any devices incompatible with Tailscale can use the proxies.

If you'd like to take a stab at this, Headscale is a self-hosted version of Tailscale's service. Personally, I use Caddy to automatically manage letsencrypt certs while proxying requests to Headscale.

Just started learning about the fediverse but I suspect everything goes down with the ship. Sort of creates a development opportunity for community driven backup utilities, though. Interesting problems are fun development challenges :)

My mistake.

Tailscale is one of those services..

Tailscale isn't an exposed service. Headscale is, and it isn't connected to the Tailnet. It's a control server used to communicate public keys and connectivity information between nodes. Sure, a threat actor can join nodes to the Tailnet should it become compromised. But have you looked at Headscale's codebase? The attack surface is significantly smaller than anything like OpenVPN.

A cert tells you that you are actually....

I'm all for ssl/tls, but it's more work and may not always be worth the effort depending upon the application, which is exactly why I recommended SmallStep+Caddy. Let's not pretend that introducing things like a CA don't introduce complexity and overhead, even if it's just distributing the root cert to devices.

MITM/DNS Hijack/ARP Poisoning....

Are you suggesting that these attack techniques are effective against zero trust tunnels? Given that the encryption values are sent out of band, via the control channel, how would one intercept and replay the traffic?

My claim is that Headscale has a lesser likelihood of compromise than Nextcloud, and that the E2EE provides an encrypted channel between nodes without an immediate need for TLS. Of course TLS over E2EE enhances CIA. There's no pushback to defense in depth here. But in the beginning, the E2EE will get them moving in the right direction.

OP began the post by stating that the login page to a complex PHP web application is internet facing (again, yikes). Given the current implementation, I can only assume that OP is not prepared to deploy a CA, and that the path of least resistance -- and bolstered security -- can be via implementation of HS+TS. They get the benefit of E2EE without the added complexity, for which there is plenty, of a CA until if/when they're ready to take the plunge.

If we're going to take this nonsense all or nothing stance, don't forget to mention that they're doing poorly unless they implement EDR, IDS, TOTP MFA on all services, myriad DNS controls, and full disk encryption. Because those components don't add to the attack surface as well, right?

Backtrack was my first consistent distro as well. Ah, the good old days of wardriving WEP! Also landed on Debian as my daily driver since Ubuntu is a bit chonk.

Anecdotal, but Ive had a container running Nextcloud in an LXC on Proxmox along with PiHole, Step CA, Bacula, and quite a few other services and I've had zero downtime since June 2023. Even have Tailscale rigged to use PiHole as the tailnet DNS to have adblocking on the go.

Guess that restart: always value in the Compose config is pulling it's weight lol

Agreed, but we have to trust the instances we keep accounts on. Trust is subjective, but I certainly wouldn't trust a government ran instance for anything other than an outlet for information originating from the owning government.

If I run a private instance or know the maintainer of another, then I can have greater confidence in the security/privacy implementations.

I've spent quite a bit of time as a penetration tester and one of the first things we do once we recover credentials is check for validity against online accounts known to be good for a given user. We do that because it simulates attackers and government operators alike. It's a guarantee that free credentials will be abused in one manner or another when they're available to government entities.

The obvious control for this is to maintain a unique password for each account but that's not always feasible for users due to myriad conditions.

Sure can! It's a bit involved and there are security considerations to take into account. Those who deploy their own instance have to make sure the underlying services are well-configured and patched. This happened yesterday, for instance. Hard to know the exact scope of the compromise, but in bad circumstances it could have compromised everyone's credentials who has registered on lemmy.world. I've no reason to believe that's the case....just saying it's a thing.

Going from bad to worse in terms of privacy.

Would I trust them to not masquerade as me?...

Masquerading is literally the term used for this.

And the divided focus is why progress on either matter is never achieved. Minor triage obviously reveals the military industrial complex to be the issue most deserving of our attention.

TBF, scientific studies seem to support that ketosis can influence/mitigate neurological conditions. The ketogenic diet was originally developed as a method of managing epilepsy, for instance.

The "classic" ketogenic diet is a special high-fat, low-carbohydrate diet that helps to control seizures in some people with epilepsy.

Personally, I'm giving it a try to assist with migraine management, per this study:

In total, 17 patients (73.9%) reported a reduction in the headache days, and 15 patients (65.2%) reported a reduction in headache days of at least 50% and were considered as responders.

The study itself had 23 patients iirc, so I'm sure more research needs to be done, but I'd like to avoid daily medications due to some of the undesirable side effects and I'm in good enough health to accept the risk for a few months.