tatterdemalion

joined 3 years ago

Secrets

  • Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
  • Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

  • Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
  • No SSH from the WAN. sshd on the router is not exposed to the internet at all.
  • WireGuard for remote access.
  • Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router's AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
  • Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
  • TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

  • SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = "no", and logins are key-only.
  • Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.

Thanks for sharing. I'm trying it out as a Google Keep replacement.

It's in the name. Capitalism rewards capital.

[–] tatterdemalion@programming.dev 1 points 2 days ago* (last edited 2 days ago)

Explain how I'm not using my brain.

Also in what universe is 3 short paragraphs a "book"?

[–] tatterdemalion@programming.dev -1 points 2 days ago* (last edited 2 days ago) (2 children)

I think your initial criticism is too easy to refute. If someone wants to criticize me for using LLMs because they're bad for the environment or because they're built on stolen IP, sure we can have that more nuanced discussion.

But telling me that I'm "cheating and I didn’t use my own cognitive utilities" -- you have no idea how I use LLMs. You're just assuming that I'm putting zero critical thought into the code I'm submitting. I review every line of code I submit, regardless of whether it was generated by LLM, written by hand, or a combination of both. And it is a laborious task; but my labor is more focused on decision making and designing tests than typing and fighting a compiler.

I haven't measured my productivity in any meaningful way, so I won't try to argue that LLMs are strictly more productive. That's a separate discussion. All I can say is that I prefer the workflow where I can describe my thoughts in natural language and then review generated code more than writing the code myself.

Probably best we just let them think they got one over on us.

[–] tatterdemalion@programming.dev 1 points 3 days ago (4 children)

OK what game am I playing, and who wrote the rules that say I cheated?

Not being in prolonged excruciating pain is very much part of the appeal of the transporter.

[–] tatterdemalion@programming.dev 5 points 3 days ago (1 children)

How is it not relevant? The OP is propagating a misconception.

[–] tatterdemalion@programming.dev 11 points 3 days ago (9 children)

What you described is not vibe coding. Vibe coding is when you don't read the code.

[–] tatterdemalion@programming.dev 7 points 4 days ago (1 children)

How can you hate it if you haven't learned it? You don't even know what it is.

Aww yea, gimme those sweet cheap HDDs.

 

I'm trying to create a web app that involves sharing of user-generated content, but one of the goals is that the service host operator should be blind to the content. Only authorized users should be able to see the content shared with them. This implies the content must be encrypted at rest, and users must hold custody of their private signing key.

I figure the situation requires an open source browser extension to hold onto a user's keys and decrypt content for them. The web app would still be able to browse all of the site's metadata, but any plaintext content must be siloed in the extension. The reason for using an extension is that the source code would be open source and independently verifiable, while building the same functionality into the web app would require trusting the host to serve the code you expect.

Do you think that's a reasonable tradeoff or is this asking too much from users?

The other option would be just requiring users to download an open source app for content viewing.

EDIT: Perhaps an important followup: are you OK placing trust in the host to never access your confidential data if it means you don't have to install additional client software or worry about verifying that client software's authenticity?

 

This might not be entirely on topic, but I think someone here will know the answer.

Does anyone have a working setup for streaming from jellyfin to an OLED TV (preferably LG) that supports Dolby Vision? AFAICT every device in the chain (except the server) needs to be DV-licensed.

Apparently KODI on a linux box (my current setup) cannot output DV content over HDMI.

I'm wondering if LG's native OS has a Jellyfin client that supports DV well. It's either that or:

  • Apple TV + infuse client (expensive)
  • Google TV Streamer
 

I didn't think I'd spend hours reading about this today, but some things surprised me:

  1. Just using a Playstation sounds like it won't work or will be a huge time sink.
  2. Blu ray optical drives are way more expensive than I thought
  3. The copy protections on Blu rays are exceptionally annoying, to the extent where there is really only one closed source software -- MakeMKV -- that can work around them. This post goes into some interesting details.
  4. Finding a drive that is known to work with MakeMKV is a pain. There's a brand called Pioneer that seems promising but they have stopped producing bluray drives ~~went out of business last year~~. I have no idea which model works, and it's common that secondhand sellers will swap enclosures and pass it off as a different model.
  5. Sometimes you need to flash the firmware on the drive to make it work with 4K UHD discs.

I was going to try ripping a Blu-ray that I bought recently, since I couldn't find a quality rip anywhere, but I'm pretty turned off from the whole prospect at this point.

Anyway I'm not really asking for a specific reply, I just thought this topic was interesting and I'm curious what people think about Blu rays and optical media in general. Does the future seem bleak? Are we going to be stuck with shitty WebDLs for most new content? Or is physical media here to stay?

 

Struggling to find a particular book. I was going to buy it on Rakuten Kobo, but they literally won't sell it if you're not in Japan.

112
submitted 10 months ago* (last edited 10 months ago) by tatterdemalion@programming.dev to c/asklemmy@lemmy.world
 

I think like 98% of mobile games are pretty much trash, but there are some diamonds in the rough.

In the past I've enjoyed:

  • Monument Valley
  • 2048
  • Fruit Merge
  • Hashi
  • Papers Please
  • Baba is You
  • Balatro

I'm getting bored of my usual picks lately. I'm looking for something that's quick to jump in and out to pass the time, not something heavy. But hard puzzles or strategy totally fit!

Is the FF Tactics port good? Better alternatives?

 
 

AFAICT, if a Netflix account owner sets up a VPN for their household, then anyone sharing the account who routes their Netflix traffic through that VPN would appear to be accessing Netflix from that household's WAN IP address.

Is anyone doing this? Is it really that simple or are there more challenges?

EDIT: We get it, you like torrenting. Let's keep comments on topic folks.

 

Richard once decided to read the mind of a hermit oracle who knew everything. This drove Richard insane.

I just had to act insane for multiple D&D sessions.

 
 

I ask because it would be nice to use the "I2P mixed mode" features of qbittorrent, but I want to keep my clearnet traffic on the VPN.

Background

I have I2PD running only on my home gateway for better tunnel uptime.

To ensure that torrent traffic never escapes the VPN tunnel, I have configured qbittorrent to use only the VPN Wireguard interface.

Problem

I think this means qbittorrent I2P traffic will flow into the VPN tunnel, but then the VPN host won't know how to route back to my home gateway where the SAM bridge is running.

 

I've configured my i2pd proxy correctly so things are somewhat working. I was able to visit notbob.i2p. But sometimes Firefox really likes to replace "http" with "https" when I click on a link or even enter the URL manually into the bar. I have "HTTPS-only mode" turned off, and I also have "browser.fixup.fallback-to-https" set to "false" and "network.stricttransportsecurity.preloadlist" to false.

I tried spying on the HTTP traffic in web dev tools, and I see the request gets NS_ERROR_UNKNOWN_HOST. This does not happen when using the xh CLI HTTP client, so Firefox is doing something weird with name resolution. I made sure to turn off the Firefox DNS over HTTPs setting as well, but it didn't seem to make a difference.

I assume that name resolution needs to happen in i2pd. How can I force Firefox to let that happen?

Update: Chrome works fine.

Update: I started fresh and simplified the setup and it seems fixed. I'm not entirely sure why. The only things I've changed from default are DoH and the manual HTTP proxy.

view more: next ›