Also at @me@social.k3can.us on Mastodon.
Crowdsec does it by using crowd-sourced blocklists (hence the name). So if an IP triggers a scenario on other machines, that malicious address will be proactively added to your blocklist before it ever gets a chance to impact your machine.
That is the big advantage of crowdsec over reactive-only solutions, like fail2ban.
Yep.
Never noticed a difference, myself.
The 3DS on the other hand…
What is the advantage of this over just dropping HTML files onto a USB drive?
Not often, but there’s a niche. I wish I could remember the details, but I saw someone earlier this year that was hosting a public BBS on a c64.
Same experience. 🫤
Personally, whenever I need to process anything text-based, I use perl.
Read the json into a hash, parse the values if desired, then plug the values into an html template.
It’s pretty quick to write, much easier to learn than python (in my opinion), and super powerful.
I’m a bit torn on the hardware bit, myself.
On one hand, hardware is a fundamental aspect of self hosting. There’s already a portion of the community who considers self-hosting to include using commercially-hosted cloud services (as long as it’s not Google), so prohibiting hardware discussion just reinforces that concept. Plus, it can be really fun to see what creative hardware people come up. I’m pretty sure I posted about my Fediverse server running on a WiFi router here, for example. The focus was on the unusual hardware, but it was also clearly related to self-hosting.
On the other hand, looking at what is posted in other communities, I don’t think there’s a ton of value in seeing a dozen photos of a bone-stock rpi or a closed laptop sitting on a desk. Same with the nth post asking if their 30-year-old 1u would be a good choice for Jellyfin; so I see why the rule exists.
Overall, though, I think hardware should be allowed, but maybe add a rule along the lines of “if you’re posting a question, please include what resources you’ve already reviewed or troubleshooting steps you’ve already taken.”
Heck, that might be a good rule for all questions, regardless of topic…
The first one. The service is owned by root, but the application is running as an unprivileged system user.
Quadlets work like any other systemd service.
You create the user/group you want to run as on the underlying system, then just specify that user/group in the quadlet file.
If you look at my *arr examples, you can see the user and groups they’re running as.
Podman quadlets can also auto-update and auto rollback, if needed.
I use LOTW because my logging software of choice, Wavelog, can automate most of the process. The only headache is the initial certification, and the process I had to go through to request a new one after accidentally wiping the previous one. I thankfully never have to touch TSQL to submit my QSOs.
I sort of understand the other ham’s opinion that “doing it for the other station” might provide motivation to submit logs to a service you don’t personally use, but that’s less true when the service in question is as poorly implemented as LOTW.
QRZ, while it has some drawbacks, does a great job as an online QSO book. It supports 2FA to secure your account, but requires no extra software or presents barriers to prevent you from adding records to your own logbook once signed in. It also offers a fairly simple API for use with 3rd party software. It can match within its own logs, and will also honor matches imported from LOTW, making it my central “source of truth” for QSL-based awards.
LOTW is a hacky solution in search of a question. Despite its GPG-esque security, it does nothing to prove that a contact actually occurred and I could just as easily submit false records to LOTW as I could any other logbook.
Same here.
Pulling doesn’t work if you don’t know when a system will be online, so it only makes sense for my laptop to push.
Seems to be specific to rewrites using an un-named capture.
grep -rnE "\$[0-9.*].*\?" /etc/ngnix
should show if you have any potentially vulnerable directives in your config.
It’s a function of a “pod” within podman.
I wrote the podman examples for AudioMuseAI using a pod: https://github.com/NeptuneHub/AudioMuse-AI/tree/main/deployment/podman-quadlets
And I have an example *arr suite on my GitHub page: https://github.com/K3CAN/podman-arr-quadlets
I’ll second podman quadlets. Good security, full integration with systemd, pods allow applications to easily share a namespace, and you can manage graphically through Cockpit if you really want to.
The only systems with ip6v in my network are Wi-Fi devices and my public-facing reverse proxy. I use a prefix delegated by my ISP.
All of my non-public servers have ipv4 only.
I use Wireguard.
For my phone, I use the “WG Tunnel” app: https://github.com/wgtunnel/android
It’s nice because it’ll automatically enable/disable it as I move between networks.
Before that, though I used the official client and I just kept it on 24/7. It’s not like it uses extra data or battery or anything.
Correct. Full-upgrade is the new term. It’s an alias, though, so using either will accomplish the same thing.
I didn’t see an obvious link to the source code, so here it is for those interested: https://github.com/Drop-OSS/drop