fonix232
@fonix232@fedia.io
- Comment on How do you isolate a printer in your homelab? 7 hours ago:
VLANs. You create an IoT VLAN, set it to be accessible the specific way you want, and you're done.
If you want to be extra secure you can fire up a Docker container that sits on this VLAN + your regular network, and proxies printer requests between the two, so you have perfect control over what happens and when.
Fair note, none of the apps (e.g. AirPrint) will work this way. They use Brother's cloud to connect to the printer.
- Comment on Putin demands Russian data centers supply capacity to the state in wake of Ukraine drone attacks — 10% capacity must be available for state IT infrastructure with 24 hours' notice 1 week ago:
I'm really curious how the Russian middle class - the "too rich and influential to go to war, but not rich or influential enough to be a self sustaining oligarch" class - will react to when their Yandex smart home or AI, VK, etc. becomes unusable because Putin demands all data centers to provide capacity to the military... Will there be another round of those sob videos like when they did the whole "those evil Ukrainians blew up our warehouses and ruined our businesses/lives when we didn't even do anything to them" spiel?
- Comment on OIDC Recommendations? 1 week ago:
Doesn't VoidAuth already provide an LDAP compatible interface for downstream devices? I recall reading about it a while back.
- Comment on 1 week ago:
There really isn't one.
Trust me. I've worked for WBD for 4+ years specifically on the video playback component for Android devices - so my day job was literally testing streaming boxes and smart TVs.
That job made me switch from EVERY single other TV smart box, to Apple. Why, you might ask? Well, it's because ALL streaming oriented boxes suck ass. Apple is the only one who puts appropriate hardware into their products.
Lets start with Android, my field. The ONLY usable box is the Nvidia Shield, which, to date, costs upwards of £200. For hardware that was already kinda dated in 2019, when it released 7 years ago. Even Google's options lack RAM, and focus too much on the codec of the SoC instead power. This means nice playback, but awful user experience in menus and any other non-video functionality.
Your best bet, if you want to hand-roll a solution, is to buy a more expensive, high end SBC and hope for good support. You'll lose DRM, though, which means no official streaming apps (or, for the ones that do work, low resolution/fidelity playback only).
If it's Steam Link you want, get dedicated hardware for that. Even a Pi4/5 will do. Use it for Steam Link only, and keep the Apple TV for media.
- Comment on 2 weeks ago:
To be perfectly fair, we've come a long, long way from 20-30 years ago when most firewalls were static or at best heuristic.
Today you can integrate solutions like CrowdSec into your reverse proxy setup (which, let's be fair, most people hosting things will be using to some extent), and transparently scans all requests for known exploit fingerprints.
Basically, if you've done the bare minimum of opsec, most likely your setup will be safe from being compromised, even if you're running an exploitable version of the problem software/stack.
And that's just a free and open source solution to securing your hosting - you can further deploy DPI based IDPs, analytics that spots irregular traffic patterns, especially in commercial environments, to protect against such attacks. It's not a guarantee, but such layered security at the very least adds some deterrence.
- Comment on PSA: eMudhra Intermediate CA Compromise 2 weeks ago:
Random website: your password must include lower and upper case characters, numbers, special characters, emojis, invisible UTF-16 characters, be at least 32 digits long, contain no repeating sequences, mathematical sequences, musical sequences, a random episode number of Friends, parts of your username, email, mother's name, father's name, address, social security number, childhood address street name, first pet's name, any date between 32 March 1928 and 1 Feb 2077, or the special character ë̷̡̡̨̡̬̜̲̫̼̠̙̱̝̖̝̞͕͉͎̿́̂͗͂̉͐͑͐̀͗̔̊̈́̅̑͘͠ͅ.
CA private key security: "Pick a number between 0 and 10443888814131525066917527107166243825799642490473837803842334832839539079715574568488268119349975583408901067144392628379875734381857936072632360
8785136527794595697654370999834036159013438371831442807001185594622637631883939771274567233468434458661749680790870580370407128404874011860911446797778359802900668693897688178778594690563019026094059957945343282346930302669644305902501597239986771421554169383555988529148631823791443449673408781187263949647510018904134900841706167509366833385055103297208826955076998361636941193301521379682583718809183365675122131849284636812555022599830041234478486259567449219461702380650591324561082573183538008760862210283427019769820231316901767800667519548507992163641937028537512478401490715913545998279051339961155179427110683113409058427288427979155484978295432353451706522326906139490598769300212296339568778287894844061600741294567491
9823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335"User: guess 4 will do
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
What the fuck are you on about?
- Docker doesn't require podman at all
- Learning the basics of Docker isn't that complex. Certainly isn't as complex as learning how to run VMs on a dedicated headless server.
- If you look up "install docker", the first hit is, 9 out of 10 times, Docker Engine. NOT the desktop app...
- No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass, network gear management was ass, and you didn't have forums and Reddit and Wikipedia and websites hosting manuals, tech blogs and guides and so on.... Then setting up Jellyfin, which is a fraction of the complexity of your job 30 years ago, should be straightforward. I am arguing that if you were capable of configuring complex services and devices 30 years ago, then today, with a million times more information readily available at your fingertips, you should be able to set up a simple service.
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
First it's a VM because I'm not going mess around with stuff on bare metal.
Containerisation method doesn't matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.
The entire point is to be able to say "here's your config folder where you can write shit, but not execute; here's the data folder where you can neither write or execute shit; and here's the read-only executable layer of the image/VM/container".
Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.
Regardless how you're hosting it, a reverse proxy is necessary. Even with a VM.
Here's a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)
Then there's setting up the certificate with the dns provider.
Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.
So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me".
So the problem wasn't Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP...
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
Beside, that wasn't even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.
Port setup and it's perceived impossibility by you has naught to do with that topic.
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
It's literally just:
- create docker container
- forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
- forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS
I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.
- Comment on Steam Controller Shipping 3 weeks ago:
Already done so, waiting on a reply
- Comment on Steam Controller Shipping 3 weeks ago:
You made me check my inbox. Of course every single fucking Steam newsletter is in my proper inbox, but the ONE email I was expecting, my Controller reservation, got dumped into spam... and I'm just beyond the 3 day reservation period.
fuck.
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
Not if your Jellyfin is set up correctly.
Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.
Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
Hopefully with a firewall
- Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer 3 weeks ago:
And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.
- Comment on HomeAssist Kiosks 3 weeks ago:
I have tablets in my home, with batteries (as fallback in case of power loss - my HA instance and router/APs are on UPS).
I'm using older (thus cheaper) Samsung tablets. Fully Kiosk works well, but recently I've started adding kiosk features to the HA Android app (no public PRs yet so it's a few months away) to add some features (mostly sleep/wake via audio/camera motion, sleep screens, default pages for the specific instances etc.), so I can ditch FK.
Battery bloat is an issue - my Tab S6 is on its third battery (though admittedly it is nearly 7 years old now, got it January 2020), and my Tab S5e lasted 3.5 years until its battery started getting spicy. I've switched both to LineageOS to reduce heating + have more control over charging/discharging, and that so far seems to have helped. Unfortunately Samsung tablets don't support running off of USB without a battery (they bootloop if no cell is detected), so pulling the battery and running them off a wall outlet isn't really an option.
To me, a Pi or similar SBC with a touchscreen just seemed like a very hacky solution. I rent so I can't add a box in the wall for the board and PSU, and tablets are just more elegant. Throw in a 3D printed enclosure/mount, and you're golden.
I use mine regularly, especially since they wake whenever I walk past them.
- Comment on PC shipments fall 20.1 percent in “sharpest decline” since Q1 2023 4 weeks ago:
Well gee wonder why that be, maybe because hardware that was £150-200 a year and half ago is now £500+?
- Comment on too real 4 weeks ago:
TBF I was going all out 😂but yeah the fact that my build essentially tripled in price is insane.
- Comment on too real 4 weeks ago:
I built my PC in 2024. Okay specs - 7950X3D, 2x 48GB DDR5-6400, 4090, 1+4TB Samsung 990, all watercooled. About £4k total.
Today I could sell that PC for about 10-12k. RAM was originally £300, now it's £1800 IF you can buy it. The storage also cost me around £400, today, easily £1500.
- Comment on "A dried husk of a product": former Doom producer berates Microsoft for making Halo a "mid-tier" game and mourns the "financialisation" of AAA 1 month ago:
20 or so years ago, AAA titles were indeed big budget, but most of the game decisions were up to the developers and artists working on it.
Today, developers at studios are being forced to implement crap mechanics, change the gameplay, the story, the details, all to “make the game more viable for a large audience” in hopes of larger and larger ROI.
- Comment on Windows 11's Weather app reportedly uses 5x more RAM than macOS's Weather app, with ads to boot by XDA on August 9, 2026 2 months ago:
all this tells me that people to date still don't understand percentages and probability.
- Comment on Meta Ran Ads That Contained AI-Generated Child Sexual Abuse Imagery 2 months ago:
Epstein in a disposition stated he had his prostate removed due to cancer risks.
The coroner's report after his suicide confirmed a healthy prostate.
Which suggests the body examined by the coroner wasn't Epstein's.
- Comment on Meta Ran Ads That Contained AI-Generated Child Sexual Abuse Imagery 2 months ago:
I regularly see Facebook posts with literal calls for murder, that, after lengthy "reviews", are found to be "not against the community standards". Things like "we should really kill all the towelheads, they have no place in America"...
Meanwhile, a few weeks back I had to fight a 30 day suspension for a comment that said "[insert name here] no, Hitler was wrong, his rhetoric was hateful, and the very first targets of the Nazi party were the socialists and workers unions. Look up the Night of Long Knives.", because apparently stating historical facts, not calls to violence, IS against the community standards.
- Comment on Meta Ran Ads That Contained AI-Generated Child Sexual Abuse Imagery 2 months ago:
After miraculously regrowing their prostates, no less
- Comment on All Steam Machines are shipped with a single 16gb stick 4 months ago:
Typical Dbrand.
The D always stood for douche. Which was a fun gimmick at first, but they've been freeballing a lot of their big releases recently, without any care in the world. It was ought to happen.
- Comment on Gaming soundbar can be hijacked from over 16 yards away without touch or pairing — the company allegedly refuses to label the blatant security flaw a cybersecurity risk 5 months ago:
if you've seen LLM's attempts at network pentesting...
- Comment on Steam Deck lead reveals Valve is funding ARM compatibility of Windows games “to expand PC gaming” and release “ultraportables” in the future 11 months ago:
Tell me you haven't even tried Fex without telling me.
- Comment on Steam Deck lead reveals Valve is funding ARM compatibility of Windows games “to expand PC gaming” and release “ultraportables” in the future 11 months ago:
You do realise that the same runtime that makes x86 games work on ARM, will also work for... drumroll please... regular software too?
- Comment on There Are Tons Of New Steam Deck Startup Videos Based on Games, And Hades 2's Video is Incredible 11 months ago:
It's annoying to read. That's why.
- Comment on There Are Tons Of New Steam Deck Startup Videos Based on Games, And Hades 2's Video is Incredible 11 months ago:
Can We Please Stop Editorial Capitalising Titles - It Is Super Annoying And Adds No Value Nor Does It Make Your Blog More Distinguished.