Comment

Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer

Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90’s until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet.

First it’s a VM because I’m not going mess around with stuff on bare metal. Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick. Then there’s setting up the certificate with the dns provider. So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”

source

Sort:hotnew top

fonix232@fedia.io ⁨1⁩ ⁨day⁩ ago

First it's a VM because I'm not going mess around with stuff on bare metal.

Containerisation method doesn't matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

The entire point is to be able to say "here's your config folder where you can write shit, but not execute; here's the data folder where you can neither write or execute shit; and here's the read-only executable layer of the image/VM/container".

Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

Regardless how you're hosting it, a reverse proxy is necessary. Even with a VM.

Here's a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

Then there's setting up the certificate with the dns provider.

Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me".

So the problem wasn't Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP...

source
- Blue_Morpho@lemmy.world ⁨1⁩ ⁨day⁩ ago
  
  Jellyfin but you not being able to follow a dead simple guide.
  
  The fact that others had the same problem without solution means it isn’t follow a dead simple guide. There are multiple guides. Just setting up docker means you have to already know to not use it and run podman. Because if you follow the online guides on docker’s own website, you end up with a docker gui and their AI assistant installed.
  
  And to think you were running a whole ass ISP…
  
  You are arguing that setting up an Internet server is as simple as it was 30 years ago. You are arguing for the sake of arguing.
  
  source
  - fonix232@fedia.io ⁨1⁩ ⁨day⁩ ago
    What the fuck are you on about?
    
    Docker doesn't require podman at all
    
    Learning the basics of Docker isn't that complex. Certainly isn't as complex as learning how to run VMs on a dedicated headless server.
    
    If you look up "install docker", the first hit is, 9 out of 10 times, Docker Engine. NOT the desktop app...
    
    No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass, network gear management was ass, and you didn't have forums and Reddit and Wikipedia and websites hosting manuals, tech blogs and guides and so on.... Then setting up Jellyfin, which is a fraction of the complexity of your job 30 years ago, should be straightforward. I am arguing that if you were capable of configuring complex services and devices 30 years ago, then today, with a million times more information readily available at your fingertips, you should be able to set up a simple service.
    
    source
    Blue_Morpho@lemmy.world ⁨1⁩ ⁨day⁩ ago
    
    Docker doesn’t require podman at all
    
    Podman isn’t an addon for docker. Podman is the open source alternative containerizer to docker. When I first encountered Docker’s AI Bonzai buddy called Gordon, Lemmy responded with, “Lol, everyone knows to not run Docker.”
    
    No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass,
    
    Documentation was far more thorough and accurate than today. First was everything was simpler. No VMs, No Containers. No https certificates unless they were e-commerce. The second reason is that documentation wasn’t an afterthought because the project is done by volunteers. I got a 100+ page binder from Netscape just to cover how to configure their build kit. (The software to make a customized installation CD.)
    
    The last important factor was the rate of change was slower so the documentation you got in 1996 was still completely accurate in 1999.
    
    source