[-] moonpiedumplings@programming.dev 24 points 2 weeks ago

Mongodb is proprietary.

Postgres is open source, and then there is documentdb which adds a mongodb compatible layer on top.

But it would probably be better just to use postgres + jsonb directly for that case.

[-] moonpiedumplings@programming.dev 22 points 3 months ago

Absolutely, this is an admirable project.

But the first thing you should know is that QubeOS is not based on Linux, but is actually a different kernel, Xen. The Xen kernel virtualizes Linux, and all Linux runs under it.

Networking and hardware access is done by certain VM's having devices (like the ethernet card or monitor/keyboard) passed through them, where Linux then handles the hardware access with it's drivers.

This is important to understand that, because QubeOS is not a Linux distro. Really, it's just that they selected Linux (it was either Debian or Fedora IIRC) as their management VMs.

But once you understand that it's absolutely feasible to adjust the VM's. It's probably easier to modify a LInux distro (or create your own) and use that for all the VM's, and then to reuse Qube's management related software. That way you could do something like ship a version of debian that disables non-free software and firmware in the debian repos. Doing that is probably easier than creating your own distro entirely from scratch.

Another interesting thing about Qubes is that you are not limited to Linux. Of course, using Linux will be easiest. But the management VM's can technically be any OS that supports it.

[-] moonpiedumplings@programming.dev 21 points 4 months ago

This is bad, but I don't really care.

On iOS, all browsers are forced to use the safari/webkit browser engine, which simply isn't as modern in terms of security as actual firefox. There is a reason this bug only affects firefox on iOS, and that's probably why.

Blame Apple. Not Mozilla.

[-] moonpiedumplings@programming.dev 20 points 4 months ago

My favorite pro is league of legends support.

[-] moonpiedumplings@programming.dev 24 points 6 months ago* (last edited 6 months ago)

a grand scale with the XZ backdoor

The XZ backdoor, affected a lot less machines than you think. It did not affect:

  • Debian Stable, or Red Hat Enterprise Linux (and rebuilds) — RHEL/rebuilds
  • Linux distros that did not integrate ssh into ssytemd
  • Linux distros that do not use systemd

The malicious code never made it into RHEL or Debian. Both of those distros have a model of freezing packages at a specific version. They then only push manually reviewed security updates, ignoring feature updates or bugfixes to the programs they are packaging. This ensures maximum stability for enterprise usecases, but the way that the changes are small and reviawable also causes them to dodge supply chain attacks like xz (it also enables these distros to have stable auto update features, which I will mention later). But those distros make up a HUGE family of enterprise Linux machines, that were simply untouched by this supply chain attack.

As for linux distros that don't integrate ssh with systemd or non systemd distros being affected, that was because the malware was inactive in those scenarios. Malicious code did make it there, but it didn't activate. I wonder if that was sloppiness on the part of the maker of the malware, or intentional, having it activate less frequently as a way of avoiding detection?

Regardless, comparing the XZ backdoor to the recent NPM and other programming language specific package manager supply chain attacks is a huge false analogy. They aren't comparable at all. Enterprise Linux distros have excellent supply chain security, whereas programming language package managers have basically none. To copy from another comment of mine about them:

Debian Linux, and many other Linux distros, have extensive measures to protect their supply chain. Packages are signed and verified, by multiple developers, before being built reproducibly (I can build and verify and identical binary/package). The build system has layers, such that if only a single layer is compromised, nothing happens and nobody flinches.

Programming langauge specific package repos, have no such protections. A single developer has their key/token/account, and then they can push packages, which are often built on their own devices. There are no reproducible build to ensure the binaries are from the same source code, and no multi-party signing to ensure that multiple devs would need to be compromised in order to compromise the package.

So what happened, probably, is some developer got phished or hacked, and gave up their API key. And the package they made was popular, and frequently ran unsandboxed on devs personal devices, so when other developers downloaded the latest version of that package, they got hacked too. The attackers then used their devices to push more malicious packages to the repo, and the cycle repeats.

And that’s why supply chain attacks are now a daily occurrence.

And then this:

You should probably turn off Dependabot. In my experience, we get more problems from automatic updates than we would by staying on the old versions until needed.

Also drives me insane as well. It's a form of survivorship bias, where people only notice when automatic upgrades cause problems, but they completely ignore the way that automatic security upgrades prevent many issues. Nobody cares about some organization NOT getting ransomwared because their webserver was automatically patched. That doesn't make the news the way that auto upgrades breaking things does. To copy from yet another comment of mine

If your software updates between stable releases break, the root cause is the vendor, rather than auto updating. There exist many projects that manage to auto update without causing problems. For example, Debian doesn't even do features or bugfixes, but only updates apps with security patches for maximum compatibility.

Crowdstrike auto updating also had issues on Linux, even before the big windows bsod incident.

https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/

It's not the fault of the auto update process, but instead the lack of QA at crowdstrike. And it's the responsibility of the system administrators to vet their software vendors and ensure the models in use don't cause issues like this. Thousands of orgs were happily using Debian/Rocky/RHEL with autoupdates, because those distros have a model of minimal feature/bugfixes and only security patches, ensuring no fuss security auto updates for around a decade for each stable release that had already had it's software extensively tested. Stories of those breaking are few and far between.

I would rather pay attention to the success stories, than the failures. Because in a world without automatic security updates, millions of lazy organizations would be running vulnerable software unknowingly. This already happens, because not all software auto updates. But some is better than none and for all software to be vulnerable by default until a human manually touches it to update it is simply a nightmare to me.

[-] moonpiedumplings@programming.dev 22 points 6 months ago

No, because proton is not Windows. Wine only works on Linux, so it's actually a Linux platform. I consider every developer/publisher who targets proton to actually be targeting Linux, rather than windows. Every single time a windows update breaks something that continues to work on proton I laugh

See also: https://steamcommunity.com/app/221410/discussions/8/1734336452576620754/?l=czech

[-] moonpiedumplings@programming.dev 22 points 7 months ago* (last edited 7 months ago)

FreeBSD, OpenBSD and NetBSD are behind Linux.

Look, I dislike permissive licenses too, but you need a source to back this claim up.

Right now, each BSD does something special, that Linux (distro's) can't trivially replace, even if the usecase is more niche. NetBSD Dev's make efforts to get it running on many devices as they can. OpenBSD (and it's subprojects) are highly secure, moreso than Linux. Who do you think makes our beloved OpenSSH? OpenSSH noted for having very few vulnerabilities over it's two decade long existence, and OpenBSD itself is similar, which is insane because there are products with multiple bad vulnerabilities every year (Linux being one of them...). This is due to a highly security minded architecture - one that Linux lacks.

FreeBSD is like Linux before systemd. I like systemd, but systemd is really trying to be kubernetes on a single node. I like systemd because I like kubernetes, but I understand why someone wouldn't like it, and I question if "single node k8s" is the best architecture for a single server or personal desktop. The ports system results in freebsd packaging many server services that aren't packaged on Linux. Being able to manage those through the system package manager, and the conviniences that provides, is nice.

Different, and not popular don't mean bad.

[-] moonpiedumplings@programming.dev 20 points 8 months ago

As far as I know, there is no programmatic way to destroy an existing pizza. terraform destroy is implemented on the client side, by consuming the pizza.

You want either mattermost or the whole matrix stack (backend, plus element with voice/video calls).

Matrix/Element is more of a discord alternative, whereas mattermost tries to be more of a slack alternative, where it seems to have some calendar integrations.

The mitre cve database is more like that big block just below what's being pointed too.

But it does look like they have a backup plan: https://www.thecvefoundation.org/

[-] moonpiedumplings@programming.dev 22 points 2 years ago* (last edited 2 years ago)

Aw yeah! This is where my knowledge of absurdly good but extremely niche games comes in. I think I'll make multiple replies to this comment.

Chronosphere

Think enter the gungeon combined with superhot, but simplified a lot. It's a turn based bullet hell, and an excellent arcade game playable in the browser.

EDIT: I'd also like to take this oppurtunity to talk about flashpoint. Flashpoint is a massive archive of basically every flash game and animation, and you can even play them again.

However, in addition to flash projects, I also noticed that flashpoint also archives HTML/HTML5 games... but only a subset of them. Although flashpoint's primary purpose still is as a flash archive, it can also be used as a curated list of HTML5 games.

Here is a website that lets you search the flashpoint database

114
submitted 2 years ago* (last edited 2 years ago) by moonpiedumplings@programming.dev to c/linux@programming.dev

I couldn't get any of the OS images to load on any of the browsers I tested, but they loaded for other people I tested it with. I think I'm just unlucky.

Linux emulation isn't too polished.

32
submitted 2 years ago* (last edited 2 months ago) by moonpiedumplings@programming.dev to c/linux@lemmy.ml

According to the archwiki article on a swapfile on btrfs: https://wiki.archlinux.org/title/Btrfs#Swap_file

Tip: Consider creating the subvolume directly below the top-level subvolume, e.g. @swap. Then, make sure the subvolume is mounted to /swap (or any other accessible location).

But... why? I've been researching for a bit now, and I still don't understand the benefit of a subvolume directly below the top level subvolume, as opposed to a nested subvolume.

At first I thought this might be because nested subvolumes are included in snapshots, but that doesn't seem to be the case, according to a reddit post... but I can't find anything about this on the arch wiki, gentoo wiki, or the btrfs readthedocs page.

Any ideas? I feel like the tip wouldn't just be there just because.

I put my solution as a comment so people who sort by new comments see the update.

23
submitted 2 years ago* (last edited 2 years ago) by moonpiedumplings@programming.dev to c/foss@beehaw.org

I've recently done some talks for my schools cybersecurity club, and now I want to edit them.

My actual video editing needs are very simple, I just need to clip parts of the video out, which basically every editor can do, as per my understanding.

However, my videos were recorded from my phone, and I don't have a presentation mic or anything of the sort, meaning background noise, including people talking has slipped in. From my understanding, it's trivial to filter out general noise from audio, as human voices have a specific frequency, even "live", like during recording or during a game, but filtering voices is harder.

However, it seems that AI can do this:

https://scribe.rip/axinc-ai/voicefilter-targeted-voice-separation-model-6fe6f85309ea

Although, it seems to only work on .wav audio files, meaning I would need to separate out the audio track first, convert it to wav, and then re merge it back in.

Before I go learning how to do this, I'm wondering if there is already an existing FOSS video editor, or plugin to an editor that lets me filter the video itself, or a similar software that works on the audio of videos.

11
submitted 2 years ago* (last edited 2 years ago) by moonpiedumplings@programming.dev to c/askscience@lemmy.world

cross-posted from: https://programming.dev/post/6822168

I was watching a twitch streamer play the game pogostuck (A game similar in frustration and difficulty to Getting over it with Bennett Foddy — Don't Fall!).

They were also reading chat at the same time (usually out loud, as well). Multitasking.

Lots of sources (here's one) say that true multitasking is impossible. Rather, it's very fast switching, where there is a degradation of performance.

Knowing this, I naturally made it my mission to trip the streamer up with seemingly benign messages.

I was sharing some actual information about another streamer who beat another game, but a made a typo something like:

I remember a streamer beat the game a game ...

And I noticed how much more the streamer struggled to read this compared to previous, accidental typos (missing spaces, extra spaces, etc.). He spent a good 5 seconds on this message, and during the process, he fell really far. 😈

So I decided to do some testing. Inserting words, swapping them around, and whatnot, to see what tripped him up the most. Most typos didn't affect him.

There was one typo that tripped him again, where I said something like:

If it wasn't for a for

So it seems to be repetition? But I couldn't always replicate this with other forms of repetition.

Later on, I copied the two guards riddle, with an alteration:

One of the guards always lies and the other always lies as wekk. You don't know which one is the truth-teller or the liar either. However both guards know each other

Sadly, I didn't cut the part about "don't know which is truth teller or liar" out.

The streamer spent a good 5 minutes interpreting this puzzle, and eventually interpreting it as the original puzzle. Then, he was trying to solve a riddle, game, and read chat all at once.

He was stuck on the bottom until he gave up on the riddle (I revealed that I meant what I said when I said both guards lie). 😈

Anyway, that was a bit off topic but still relevant.

I'm wondering if any studies have been done on this? I know studies have been done on human's ability to read words with the letters partially scrambled, but what about typos?

How can I improve my distraction game (with plausible deniability of course)?

17

I was watching a twitch streamer play the game pogostuck (A game similar in frustration and difficulty to Getting over it with Bennett Foddy — Don't Fall!).

They were also reading chat at the same time (usually out loud, as well). Multitasking.

Lots of sources (here's one) say that true multitasking is impossible. Rather, it's very fast switching, where there is a degradation of performance.

Knowing this, I naturally made it my mission to trip the streamer up with seemingly benign messages.

I was sharing some actual information about another streamer who beat another game, but a made a typo something like:

I remember a streamer beat the game a game ...

And I noticed how much more the streamer struggled to read this compared to previous, accidental typos (missing spaces, extra spaces, etc.). He spent a good 5 seconds on this message, and during the process, he fell really far. 😈

So I decided to do some testing. Inserting words, swapping them around, and whatnot, to see what tripped him up the most. Most typos didn't affect him.

There was one typo that tripped him again, where I said something like:

If it wasn't for a for

So it seems to be repetition? But I couldn't always replicate this with other forms of repetition.

Later on, I copied the two guards riddle, with an alteration:

One of the guards always lies and the other always lies as wekk. You don't know which one is the truth-teller or the liar either. However both guards know each other

Sadly, I didn't cut the part about "don't know which is truth teller or liar" out.

The streamer spent a good 5 minutes interpreting this puzzle, and eventually interpreting it as the original puzzle. Then, he was trying to solve a riddle, game, and read chat all at once.

He was stuck on the bottom until he gave up on the riddle (I revealed that I meant what I said when I said both guards lie). 😈

Anyway, that was a bit off topic but still relevant.

I'm wondering if any studies have been done on this? I know studies have been done on human's ability to read words with the letters partially scrambled, but what about typos?

How can I improve my distraction game (with plausible deniability of course)?

9

cross-posted from: https://programming.dev/post/5669401

docker-tcp-switchboard is pretty good, but it has two problems for me:

  • Doesn't support non-ssh connections
  • Containers, not virtual machines

I am setting up a simple CTF for my college's cybersecurity club, and I want each competitor to be isolated to their own virtual machine. Normally I'd use containers, but they don't really work for this, because it's a container escape ctf...

My idea is to deploy linuxserver/webtop, as the entry point for the CTF, (with the insecure option enabled, if you know what I mean), but but it only supports one user at a time, if multiple users attempt to connect, they all see the same X session.

I don't have too much time, so I don't want to write a custom solution. If worst comes to worst, then I will just put a virtual machine on each of the desktops in the shared lab.

Any ideas?

19
submitted 2 years ago* (last edited 2 years ago) by moonpiedumplings@programming.dev to c/linux@lemmy.ml

docker-tcp-switchboard is pretty good, but it has two problems for me:

  • Doesn't support non-ssh connections
  • Containers, not virtual machines

I am setting up a simple CTF for my college's cybersecurity club, and I want each competitor to be isolated to their own virtual machine. Normally I'd use containers, but they don't really work for this, because it's a container escape ctf...

My idea is to deploy linuxserver/webtop, as the entry point for the CTF, (with the insecure option enabled, if you know what I mean), but but it only supports one user at a time, if multiple users attempt to connect, they all see the same X session.

I don't have too much time, so I don't want to write a custom solution. If worst comes to worst, then I will just put a virtual machine on each of the desktops in the shared lab.

Any ideas?

43

So basically, my setup has everything encrypted except /boot/efi. This means that /boot/grub is encrypted, along with my kernels.

I am now attempting to get secure boot setup, to lock some stuff, down, but I encountered this issue: https://bbs.archlinux.org/viewtopic.php?id=282076

Now I could sign the font files... but I don't want to. Font files and grub config are located under /boot/grub, and therefore encrypted. An attacker doing something like removing my hard drive would not be able to modify them.

I don't want to go through the effort of encrypting font files, does anyone know if there is a version of grub that doesn't do this?

Actually, preferably, I would like a version of grub that doesn't verify ANYTHING. Since everything but grub's efi file is encrypted, it would be so much simpler to only do secure boot for that.

And yes, I do understand there are security benefits to being able to prevent an attacker that has gained some level of running access to do something like replacing your kernel. But I'm less concerned about that vector of attack, I would simply like to make it so that my laptops aren't affected by evil maid attacks, without losing benefits from timeshift or whatnot.

I found the specific commit where grub enforces verification of font files: https://github.com/rhboot/grub2/commit/539662956ad787fffa662720a67c98c217d78128

But I don't really feel interested in creating and maintaining my own fork of grub, and I am wondering if someone has already done that.

12

I'm having trouble with networking on linux. I am renting a vps with only one NIC, one ipv4 address, and a /64 range of ipv6 ones. I want to deploy openstack neutron to this vps, but openstack neutron is designed to be ran on machines with two NIC's, one for normal network access, and entirely dedicated to virtualized networking, like in my case, giving an openstack virtual machine a public ipv6 address. I want to create a virtual NIC, which can get it's own public ipv6 addresses, for the vm's, without losing functionality of the main NIC, and I also want the vm's to have ipv4 connectivity. I know this setup is possible, as the openstack docs say so, but they didnt' cover how to do so.

Docs: https://docs.openstack.org/kolla-ansible/latest/reference/networking/neutron.html#example-shared-interface

There is an overview of what you need to do here, but I don't understand how to turn this into a usable setup. In addition to that, it seems you would need to give vm's public ipv4 addresses, in order for them to have internet connectivity. I would need to create a NAT type network that routes through the main working interface, and then put the neutron interface partially behind that, in order for ipv4 connectivity to happen.

I've been searching around for a bit, so I know this exact setup is possible: https://jamielinux.com/docs/libvirt-networking-handbook/multiple-networks.html#example-2 (last updated in 2016, outdated)

But I haven't found an updated guide on how to do it.

view more: ‹ prev next ›

moonpiedumplings

0 post score
0 comment score
joined 3 years ago