lambalicious

@lambalicious@lemmy.sdf.org

• ⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  Hmmm, I’d… say… “get a better phone”, but there’s not much of a better alternative there.

  Get a desktop / laptop computer?

• ⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  Safari

  Get a better browser? HTTP is as legit a transmission protocol as HTTPS and email are.

• ⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  That sounds interesting. But then you have to convince your peers to install your certificate root, right?

• ⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  HTTPS for everything means you have to buy into the cartel of “identity providers” that manage DNS and certificates, even if there are some mostly-good actors in there such as Let’s Encrypt, you still have the external dependency. As we have seen with cases such as Austistici, having that dependency can be a problem. It’s your call if it is in your case or not, but I wanted to raise this point because no one has pointed out that particular weakness vector so far in the thread.

  In a very general sense, if your services are under a netbird or any sort of VPN where you control who gets account access or not, you “should not need” HTTPS. Might still be convenient to have.

• ⁨Comment⁩ on ⁨How much pain should I expect upgrading my server from Debian 12 to 13?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  The fewer packages you have installed, the easier it is to upgrade. So if your stuff is containerized, upgrade should be mostly painless.

  In my history at least, dist-upgrades have never themselves been a problem, not even when doing such things as a x86-to-x64 crossgrade upgrade (from Stretch to Buster, back in the time). The problem usually comes right after, with the first reboot, when something does not generate correctly in Grub or the new kernel’s initramfs is lacking a specific module, or a given mariadb flag you were counting on is no longer added by default, or somesuch. So always have a rescue boot ready.

• ⁨Comment⁩ on ⁨Container Vulnerability Management⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).

• ⁨Comment⁩ on ⁨For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.

• ⁨Comment⁩ on ⁨⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

  (Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

• ⁨Comment⁩ on ⁨⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).

  My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.

• ⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  Hey, never said I was laughing out of happiness… 😭

• ⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  laughs in keeping an old archive site still in PHP5

• ⁨Comment⁩ on ⁨⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  This is quite simply solved by using in your presentation a site that already rebrands Anubis.

• ⁨Comment⁩ on ⁨Lutris v0.5.21 and v0.5.22 arrive with Valve's Sniper runtime support and new game runners⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  Reminder that Lutris is AI/slopware now, and the dev is proud of it.

• ⁨Comment⁩ on ⁨[PSA] Wifi warning on the refurbished OLED decks⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Wait, the Deck doesn’t have an Ethernet port?

  It’s a Linux machine!