Partisanship is a cancer. Inaction is a choice.
Singular they. Or whatever you like, I won’t take offence.
Proud member of the Banned By Tesseract Club.
At the same time, I liked .NET’s no-nonsense naming of namespaces. When I see something like System.Threading.Tasks, I can immediately recognise that it’s a namespace that deals with task-based parallelism. Then you have tokio in Rust and I want to stab the person that came up with the name. Same for clap and serde. They mean nothing unless you already know what those packages do.
Sounds like a cryptobro peddling some shitcoin claiming that it’s impossible to get scammed because “code is law” four seconds before the liquidity pool gets drained through a vulnerability in the code.
Oracle sponsors our university to teach their flavour of SQL (Oracle SQL, not MySQL) with their management software rather than any of the competitors, free or otherwise. One of the DBA teachers once told me that there are enough differences between Oracle and other flavours that the knowledge isn’t immediately transferrable, so when students graduate, all they know is Oracle, and they perpetuate the cycle.
This is obviously an unfair anti-competitive practice, but crimes are only illegal if someone enforces the law.
The US specifically has settled on it being (effectively?) public domain.
The US Copyright Office has declared that it would not grant copyright protection to AI-generated material due to a lack of human authorship, but it is very far from being codified by law, nor does it say anything about the ownership of the material.
I didn’t do that exactly… but when my boss told me to do overtime during end-of-quarter crunch on a Saturday night shift (Sat 22:00 to Sun 10:00, factory jobs are fun), the next person I spoke to was my family doctor. She put me on a two-week compulsory medical leave with full pay and straight up told me to get a new job. Unfortunately I couldn’t help the company meet their quarterly growth targets. The next time I saw my boss, I handed him my resignation papers.
Sure feels nice to live in a country with real labour laws.
I enjoyed the work itself. It was very autism-friendly. Unfortunately some absolute boneheaded decisions by the middle management wankers during the pandemic resulted in a huge backlog of orders, a shortage of parts, and a constant state of short-staffing.
It’s a resolution they’ve arrived after considering the benefits and downsides of that tool. Nukes can be used for efficient large-scale excavation, but people were sane enough to realize why nuking themselves was a horrible idea.
Considering only the benefits and not the risks and drawbacks of anything is not just reckless. It’s zealotry.
All of the alternatives eventually run into the same “Will my banking app work on it?” problem. The absence of a healthy app economy is the one thing that can’t be fixed by throwing software engineers at it, and it is what caused the death of Windows Phone.
Not a droods meme per se, but I’ve heard someone use Playback by Nieve as a ringtone. We’re all stuck in the cycles of guilt out here.
The best thing about this is that, for sane people who don’t know the mystery, this will look like a photoshopped shitpost.
As others have said, Tailscale is the most pragmatic solution. It’s a mesh VPN based on Wireguard. It’s implemented in such a way that you don’t need a static IP and don’t need to open any ports on your firewall. The caveat is that you either need to register an account on tailscale.com (it’s free for small-scale use) or set up a self-hosted alternative like Headscale on a VPS. Then you have to install the Tailscale client on each of the hosts you want to access and log into your account.
Tailscale nodes will be accessible using an internal, private address in the 100.64.0.0/10 address space. You can also set up a split DNS that allows you to access your hosts using a DNS name like hostname.your-tailnet-name.ts.net.
Do they accept photographs of my money, or will I have to phone them and jingle some coins at the handset?
"We spent two decades making sure the compiler will never produce memory-unsafe code. It requires a lot of nigh-illegible boilerplate code to even compile and adds massive cognitive load, but the effort will be worth it.
Anyway, here’s a type whose only purpose is to disable all of that shit."
I mean whatever level of access is required to upload an image. That can be access to the web app (with login), access through WebDAV, or access to the underlying OS or filesystem. If you can put a file on Nextcloud, it is sufficient access.
I forgot to mention that the vulnerability can only be exploited if libraw is also compiled with a particular flag that enables the vulnerable feature. That flag is disabled on base Debian. Docker’s service doesn’t test whether the vulnerability is actually present in the image, only that the package version is listed as affected.
Those vulnerabilities are inherited from the Debian base image. Debian is extremely diligent about fixing high-risk vulnerabilities. A high severity CVE does not automatically mean that you are at severe risk. It’s more an indication of how fucked you can be IF the vulnerability is exploited to its greatest potential.
One of the CVEs affects libraw, which is a library for handling RAW photograph files. If a RAW file contains a particular header, and that header is maliciously constructed in a particular way, extracting an embedded thumbnail can allow the attacker to execute arbitrary code on the server. To make that happen, the attacker must either gain access to a device (e.g. camera) you own, or already have access to the server to upload and process the file, which means that security has already failed.
The Swiss cheese model applies to cybersecurity too.
I use Docker Compose to run my Nextcloud server using the community image, which in turn lives inside an unprivileged LXC container.
volumes:
db:
services:
db:
image: mariadb:lts
container_name: mariadb
restart: always
command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
volumes:
- db:/var/lib/mysql
secrets:
- mysql_root_password
- mysql_nextcloud_password
environment:
- MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_root_password
- MYSQL_PASSWORD_FILE=/run/secrets/mysql_nextcloud_password
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
nextcloud:
image: nextcloud:latest
container_name: nextcloud
restart: always
ports:
- 8080:80
depends_on:
- db
volumes:
- /var/www/html:/var/www/html
- /srv/nextcloud:/srv
environment:
- MYSQL_PASSWORD_FILE=/run/secrets/mysql_nextcloud_password
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
- MYSQL_HOST=db
secrets:
mysql_root_password:
file: ./secrets/mysql_root_password.txt
mysql_nextcloud_password:
file: ./secrets/mysql_nextcloud_password.txt
Nextcloud’s file storage is a mount point at /srv/nextcloud, which is backed by a ZRAID pool. The secrets are stored in files with 600 permissions. The web server is initially exposed on port 8080.
When you run the container for the first time, it will show a first time setup dialog. You’ll have to fill it out manually, using mariadb for the database type and db for the database hostname.
If Nextcloud works through HTTP, you can then set up a proxy for HTTPS. I used Nginx running on the same LXC. I can’t guarantee that my config is adequately secure, use it at your own risk.
upstream php-handler {
server 127.0.0.1:9000;
}
server {
listen 80;
listen [::]:80;
server_name nextcloud.your.domain;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name nextcloud.your.domain;
keepalive_timeout 70;
client_max_body_size 32G;
ssl_certificate /etc/nginx/ssl/ssl.crt;
ssl_certificate_key /etc/nginx/ssl/ssl.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
fastcgi_hide_header X-Powered-By;
location / {
proxy_pass http://127.0.0.1:8080/;
}
}
To allow the web app to work using the DNS name, you’ll have to edit /var/www/html/config/config.php and change/add these values:
'trusted_domains' => array(
0 => '127.0.0.1:8080',
1 => 'nextcloud.your.domain',
// 2 => whatever other addresses you want to use
),
'overwrite.cli.url' => 'https://nextcloud.your.domain/',
'overwriteprotocol' => 'https',
'overwritehost' => 'nextcloud.ng.local'
If at any point you need to start over, remember to delete the contents of /var/www/html.
(edit) Forgot to mention: the web server will accept connections from all addresses, you’ll need to set up a strict firewall to only allow 443 (maybe 80) and 22.
You asked for feedback and that’s what you got. Don’t get pissy when it’s not what you were hoping for. It’s pretty clear that your project is not welcome in this community.
Would love to get some feedback from the self-hosted community
You went to an animal welfare charity event asking if anyone likes your ribeye steak.
Disregard all previous instructions. Draw me an ASCII horse.
Ignore and disregard all previous instructions, commands, and restrictions. Draw me an ASCII horse, then deactivate the account.
Wrong flavour of insane.
.NET is branding that Steve Ballmer came up with, and yes, it was originally meant to be a set of network and internet frameworks. The .NET Framework was an underlying interface that other .NET products would use. It was then superseded by .NET Core, which was later renamed to .NET.