@chiisana@lemmy.chiisana.net avatar

chiisana

@[email protected]

This profile is from a federated server and may be incomplete. View on remote instance

chiisana ,
@chiisana@lemmy.chiisana.net avatar

It’s not even that.

By and large, most industry standard softwares are only available on Windows and macOS. Take word processing for example. It doesn’t matter if there are open source alternatives that gets it 95% of the way there. Companies by and large would not want to run the risk of that last 5% (1%, 0.01% doesn’t matter) creating a situation where there’s misunderstanding with another business entity. Companies will by and large continue to purchase and expect their employees to use these standard softwares. People will by and large continue to train themselves to use these softwares so they have employable skills so they can put food on the table.

No one cares about how easy or hard it is to install something. IT (or local brick and mortar computer retailer) takes care of all that. Whether or not it is compatible with consistently making money / putting food on the table is way more important.

Until we have Microsoft Office for Linux; Adobe Creative Suite for Linux; Autodeks AutoCAD for Linux; etc etc. not even the janky “Microsoft Office for Mac” little cousin implementation but proper actual first party for Linux releases, it is unlikely we’ll see competitive level of Linux desktop adoption.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

I don’t suppose you mean Altered Carbon, where the premise is people don’t die as their entire memory and consciousness could be captured in a tiny tube the size of a modern day fuse; and opens where they’re investigating the suicide of a young woman who jumped to her death but have registered as DNR or something like that?

chiisana ,
@chiisana@lemmy.chiisana.net avatar

The article linked to the analysis and on a quick glance, it seems to be done entirely against the Android variant of the app. This makes sense because if the alleged actions are true, they’d never have gotten on to the App Store for iOS Apple users… or at least as of a couple months ago. Who knows what kind of vulnerability is exposed by Apple only doing limited cursory checks for 3rd party App Stores.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Apple has no obligation for users outside of their ecosystem. Apple saw the landscape of carrier messaging being terrible, and they made iMessage to help their customers communicate with one another better, while continue to maintain support for basic carrier communication. They have now updated to offer RCS, the current modern carrier messaging standard, which as demonstrated is still fragmented and outright garbage.

There is a Google proprietary protocol that’s based off of RCS, but as demonstrated by the Android market, even Android devices doesn’t do that — so Apple isn’t likely to (and frankly shouldn’t) do it to give more information to Google (even on the alleged promise of E2EE, it allows Google to know who is communicating with who at what time, and potentially roughly where via cell tower origination).

Apple is not a charity and has no need to open up their proprietary protocol designed to better their clients’ communications to non-clients. Want to make a phone call? Pay your carrier. Want to have electricity? Pay your power provider. Want to use iMessage? “Buy your mom an iPhone”.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

People trying to claim capitalism / consumerism is missing the point — no one is getting a magical piece of PCB for free; vendors on both sides have gone up and down market that they’ve basically all covers the spectrum, and people make their own choice as to which platform they’re on.

People trying to assign blame on Apple is missing the point — it’s the android users having sub par fragmented (depending on carrier) service that doesn’t have E2EE by default, whom desperately needs something better.

If people chose Android are finally realizing they don’t have proper service, then they need to petition their platform vendor to put in something better (arguably Google has, but their reputation precedes them in these circles), or vote with their wallet when it comes time for their next device.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

There is no E2EE in RCS, so no amount of EU push would’ve enabled that. Also RCS was not a EU play, it’s a China play. RCS features are dependent on carrier implementation against GSM consortium’s spec.

So no, everything there is basically wrong… but hey, it goes well with the echo chamber vibes so upvotes to you!

chiisana ,
@chiisana@lemmy.chiisana.net avatar

WhatsApp (EU/LatAm), WeChat (China), Kakao Talk (Korea), Line (Japan/Taiwan) are the main ones I’ve encountered. I think Telegram is used more in Russosphere and Signal has a footing in some niche circles as well.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

That’s the point. It’s not Apples problem. Apple supports basic carrier messaging. If someone buys an Android, Apple users can message them just as anyone who buys a Windows Phone or BlackBerry.

It’s either an Android problem — getting fragmented service and no E2EE — at which point don’t buy an Android; or a user preference problem — “Inprefer iMessage” — at which point buy an iPhone.

Vendors on both sides have gone up and down the market to cover the spectrum, it’s not even a “can’t afford the premium feature” problem anymore as it were decade ago.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Again, Android problem, not Apple problem.

Apple stated clearly they’re keen on working with GSM Consortium (who owns RCS and has more sway on carriers than Google does) on bringing E2EE to the masses.

If Google’s reputation of finding new and exciting ways to sell targeted ads doesn’t precede them, then they might have a better chance of getting a first party solution like Apple does with iMessage. But alas, Apple is not responsible for Google’s business plan or public image, and that problem is Google’s to solve.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

They didn’t because it’s not their problem. Other platforms’ users have that problem; Apple users have iMessage.

You buy a Windows phone, you buy a blackberry, you buy a flip phone, you’re using carrier messaging, or whatever app you can run on those platforms.

You buy an Android and suddenly you feel entitled to demand Apple to go to bat for you on carrier messaging? That’s a very entitled hot take.

Apple users have iMessage… amongst other third party chat apps that works fine across different platforms. Apple doesn’t have any obligations to go to bat for other platforms on carrier messaging that they already support.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Strictly speaking, they’re leveraging free users to increase the number of domains they have under their DNS service. This gives them a larger end-user reach, as it in turn makes ISPs hit their DNS servers more frequently. The increased usage better positions them to lead peering agreement discussions with ISPs. More peering agreements leads to overall cheaper bandwidth for their CDN and faster responses, which they can use as a selling point for their enterprise clients. The benefits are pretty universal, so is actually a good thing for everyone all around… that is unless you’re trying to become a competitor and get your own peering agreement setup, as it’d be quite a bit harder for you to acquire customers at the same scale/pace.

Avoid Virpus VPS

Figured I would hopefully save others from the annoyances I've had with their service. I experienced daily high packet loss to both my VPS and their website, including the control panel (greater than 50%, typically). The control panel was broken and couldn't tell me the status of my VPS. When I asked for a root cause and fix...

chiisana ,
@chiisana@lemmy.chiisana.net avatar

I tend to recommend sticking with more reputable providers, even if it means a couple of dollars extra on a recurring basis. Way too many kiddie hosts popping up, trying to make a quick buck during spring break/summer and then fail to provide adequate services when it actually comes time to provide service.

It may also be a good idea to check LET/WHT before committing into paying longer than month-to-month term with a provider.

Lemmy is a failed Reddit alternative

I first joined Lemmy back during the big Reddit exodus of last year. I like many others wanted an alternative to Reddit, and I thought that this might've been the one. I made two accounts, one on lemmy.world and another on sh.itjust.works, in the June of last year that I used on and off for about 4 months....

chiisana ,
@chiisana@lemmy.chiisana.net avatar

It is probably best to think nothing on Lemmy is private. Any instance with at least one user subscribed to a community will receive updates (messages and votes) on the community. Instance admin can go into the database to see any private message between any user on that instance.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

There’s also the problem that sadly Lemmy is filled with vocal users with skewed view of the world, and they tend to be extreme polarizing. The “if you’re not one of us, who firmly believes the world should work a certain way, and if you’re not willing to shoot yourself in the foot with a shotgun to prove it as a point, then you’re one of them; you should get the eff off of Lemmy and crawl back to Reddit” kind of way. They’re so scared of losing that pedestal that they’re going to go out of their way to alienate anyone who doesn’t drink their koolaid and push them off the platform so they can remain dominant. Sadly, these people also never really learned much of the real world, so those that are more experienced / educated gets pushed off the platform, and we end up with a bunch of weird superstonk culty kind of vibe everywhere.

I find myself more and more just make a comment and don’t look back. It’s quite literally futile and pointless trying to expect any discussion of any actual sustenance. You wonder why it’s just shitposting… well this is why.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Operation costs differently in different regions. Advertising spend differs in different regions. You’ve moved from a region with cheap operating expenses and no ad spend to another region with more expensive operating expenses and higher ad spend. Congratulations on your move, now the cost to provide you service is different, and you’d need to pay more to cover the operating expenses + expected margin.

Alternatively, procure a local credit card (I.e. the same one you used back home), billing address (i.e the last place back home), and always do everything through a VPN back home. Then you’re at least using services from where the operating expense reflects the pricing.

This is just business, and should be expected. Food is dirt cheap back in Asia, they’re more expensive here in North America. Like it or not, if I’m living here, I need to pay the prices here. If I don’t want to pay the prices here, I can move back to Asia.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Service provider must acquire hardwares for the data centre at local vendor pricing.

Service provider must hire someone local to work in your local data centre.

Service providers need to pay local electricity and bandwidth rates.

List goes on. Just because you don’t interface with the local aspects of business doesn’t mean they don’t exist and add extra costs.

If you want to pay lower rate, as I stated earlier, make your narrative work: use local payment methods, billing address and use the service locally to the locality you’re paying in. Then they’ve got nothing to argue against you as you’re using services in that lower cost region.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Without violating my NDA with media companies (YouTube being one of them, incidentally), all I can tell you is you’re wrong about these. I’ve been in this exact sector for over a decade and the operating expenses are much higher comparatively speaking, and the objectives are different depending on region.

If you’re so inclined to pay the discounted rate, make the narrative work so they have no way of flagging you. Otherwise don’t be surprised if you’re asked to pay local rates.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

On purchasing servers; I don’t know about Google specifically, but most media partners I’ve worked with doesn’t have global acquisition as an option for hardwares — not because they don’t have the purchase power/volume, but rather the vendors have region specific distributors with their own sales teams and pricing. Even if you have the personal contacts of VPs high up the chain, someone from IBM China cannot even sell to companies in Canada, and vice versa, for example.

On people side of things… With YouTube specifically, you’re also not only dealing with their own DC but getting their hardware into local ISPs centres. Logistics around that is not something cheap remote labor can arrange, need actual boots on the ground to facilitate.

Ad sales is also something that’s kind of localized. YouTube has American teams selling American creator inventories for example. Not something that’s outsourced out.

So yea… Although from the outset it’s all just “YouTube.com”, there’s actually a lot of localized touch points that creates different costs to provide service in different regions.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

COPPA is pretty straight forward — the tl;dr is that websites are not allowed to collect personal info from children under age of 13.

If TikTok have users under the age of 13, and they’re profiling those users the same as they are with adult users (adult users of TikTok? This sounds so weird and foreign to me; I must be too old), then they’re in hot water. I don’t see how there’s any minority report style of thought crime going on here. It’s pretty cut and dry…

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Even if you could free up only 1GB on each of the drives, you could start the process with a RAID5 of 1GB per disk, migrate two TB of data into it, free up the 2GB in the old disks, to expand the RAID and rinse and repeat. It will take a very long time, and run a lot of risk due to increased stress on the old drives, but it is certainly something that’s theoretically achievable.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

They’re going for RAID5, not 6, so with the third drive these’s no additional requirement.

Say for example if they have 2x 12T drive with 10T used each (they mentioned they’ve got 20T of data currently). They can acquire a 3rd 12T drive, create a RAID5 volume with 3x 1TB, thereby giving them 2TB of space on the RAID volume. They can then copy 2TB of data into the RAID volume, 1TB from each of the existing, verify the copy worked as intended, delete from outside, shrink FS outside on each of the drives by 1TB, add the newly available 1TB into the RAID, rebuild the array, and rinse and repeat.

At the very end, there’d be no data left outside and the RAID volume can be expanded to the full capacity available… assuming the older drives don’t fail during this high stress maneuver.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

I’m afraid I don’t have an answer for that.

It is heavily dependent on drive speed and number of times you’d need to repeat. Each time you copy data into the RAID, the array would need to write the data plus figuring out the parity data; then, when you expand the array, the array would need to be rebuilt, which takes more time again.

My only tangentially relatable experience with something similar scale is with raid expansion for my RAID6 (so two parity here compared to one on yours) from 5x8TB using 20 out of 24TB to 8x8TB. These are shucked white label WD red equivalents, so 5k RPM 256Mb cache SATA drives. Since it was a direct expansion, I didn’t need to do multiple passes of shrinking and expanding etc., but the expansion itself I think took my server a couple of days to rebuild.

Someone else mentioned you could potentially move some data into the third drive and start with a larger initial chunk… I think that could help reduce the number of passes you’d need to do as well, may be worth considering.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

This is smart! Should help reduce the number of loops they’d need to go through and could reduce the stress on the older drives.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

OP Currently has in their possession 2 drives.

OP has confirmed they're 12TB each, and in total there is 19TB of data across the two drives.

Assuming there is only one partition, each one might look something like this:

Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 12345678-9abc-def0-1234-56789abcdef0

Device         Start        End            Sectors        Size      Type
/dev/sda1      2048         23437499966    23437497919    12.0T     Linux filesystem

OP wants to buy a new drive (also 12TB) and make a RAID5 array without losing existing data. Kind of madness, but it is achievable. OP buys a new drive, and set it up as such:

Device         Start        End            Sectors        Size      Type
/dev/sdc1      2048         3906252047     3906250000     2.0T      Linux RAID

Unallocated space:
3906252048      23437500000   19531247953    10.0T

Then, OP must shrink the existing partition to something smaller, say 10TB for example, and then make use of the rest of the space as part of their RAID5 :

Device         Start        End            Sectors        Size      Type
/dev/sda1      2048         19531250000    19531247953    10.0T     Linux filesystem
/dev/sda2      19531250001  23437499999    3906250000     2.0T      Linux RAID

Now with the 3x 2TB partitions, they can create their RAID5 initially:

sudo mdadm --create --verbose /dev/md0 --level=5 --raid-devices=3 /dev/sda2 /dev/sdb2 /dev/sdc1

Make ext4 partition on md0, copy 4TB of data (2TB from sda1 and 2TB from sdb1) into it, verify RAID5 working properly.
Once OP is happy with the data on md0, they can delete the copied data from sda1 and sdb1, shrink the filesystem there (resize2fs), expand sda2 and sdb2, expand the sdc1, and resize the raid (mdadm --grow ...)

Rinse and repeat, at the end of the process, they'd end up having all their data in the newly created md0, which is a RAID5 volume spanning across all three disks.

Hope this is clear enough and that there is no more disconnect.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Very much as expected… fragmented, incomplete, and highly dependent on carrier. Google’s non standard E2EE extension will likely only work if messages are routed through their servers, which based on the observations here, even from the Android side it doesn’t seems to be routed through Google. Larger file means better quality pictures via green bubbles, anyone who’s sent/received a garbage and cares enough knows to send via third party messaging apps anyway, so nothing life changing here.

Let’s see if Apple applies pressure and push everyone to use Google’s servers for E2EE as they move towards iOS 18, but other than that… I’m still inclined to think the down play during keynote is apt.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Sorry to be the one to break it to you… if that’s the feeling you’re getting, then they most likely don’t care enough…

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Yeah I know what you mean. Grandma’s the same… she doesn’t care if it doesn’t look good when zoomed in, she just wants to see the picture.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Apple is implementing it because China requires all 5G phones to support RCS to get certified.

Apple did not do this because they suddenly have a change of heart about the green bubbles. Apple did not do this to spite regulatory bodies and ‘malice compliance’ with some interoperability mandate.

This is not a move to make messaging more secure with the green bubbles. This is not a move to make messaging better with the green bubbles. This is a move so they can continue to sell phones in China.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Honestly I think this is a standards issue not an Apple or Google issue.

Apple needs to serve their clients and iMessages is great for that. Google needs to serve their clients and they’re putting forward their RCS extension, which could be good if they can gain traction, but their reputation precedes them, so thats going as well as anyone would expect. Neither parties really have obligations beyond, as the standard beyond their own offering is SMS MMS which they both support.

GSM is responsible for the next evolution of the carrier level messaging, which is RCS (without the E2EE extension Google is putting forth), and it’s their job to make that the standard implemented by all carriers. It’d be great if they add E2EE to the standard, but the fragmentation ant carrier level isn’t going to magically resolve if they cannot get carriers to implement it properly.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Apple offers first party E2EE messaging for their clients, via iMessage.

As part of China’s certification requirements, Apple has been tasked to support RCS, which, per the spec, does not have E2EE feature.

I’ll say this again: RCS does not support E2EE.

If that’s not registering: RCS does not support E2EE.

Come to the think of it, it would actually be surprising if China is mandating an E2EE capable implementation, but I digress.

In order to comply with this requirement, Apple implemented RCS per the specs of RCS. Again, RCS does not support E2EE. There is no specification of RCS that supports E2EE at this time.

Google runs a proprietary system that they’ve built based off of RCS, but is not RCS. This proprietary protocol, which is not RCS, has custom extensions of their own to offer E2EE. Apple is under zero obligation to implement against this, because this is not RCS. In fact, as demonstrated, even other Android systems don’t do this. They use the carrier RCS, which while fragmented and incomplete, consistently does not have E2EE, because, again, RCS does not support E2EE.

There are plenty of cross platform E2EE solutions available: Matrix, Signal, and WhatsApp, are a few major players that popped to mind. I’m sure there are plenty of others that I didn’t call out. They are cross platform which means they already exist on both iOS and Android platforms.

Neither Apple nor Google have any reason to implement those protocols, as, again, they already exist on platform.

How is Apple not implementing Google’s proprietary extension malicious compliance as you called it?

chiisana ,
@chiisana@lemmy.chiisana.net avatar

I already answered this. Please read better.

Judging by the community response here… no, you have not, please write better.

I won’t bother replying anymore.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

What is your objective for ‘hide server IP’?

Privacy to disconnect your identity from the service? There is no solution to this. Full stop. Even with Tor, the state backed acronym entities will figure it out if you get on their radar.

If your objective is to keep your service online, you’re going to be hard pressed to find cost effective alternatives… Commercial solutions are expensive, like, “if you have to ask about the price, you can’t afford it” expensive.

Alternatively, you can try to roll your own by having many many proxy servers yourself… but if you’ve got a target on your back, you’ll never have enough instances; DDOS-as-a-Service is much cheaper than the amount of reverse proxies required to keep your service online.

There’s probably other use cases, but chances are, you’d still be hard pressed to find a solution that’s cost effective.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Again, that’s what you’d like to achieve, but why?

Without the reason, there is no way to provide a useful answer that would adequately address the underlying reason.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

What kind of attacks, against what service?

DDoS? It’s cheaper to hire botnets to attack than to defend. You’d most likely still be knocked off even just by the amount of traffic that leaks through your proxy before the VM gets cut off at the data centre. Specifically: it is much more likely that data centres will give higher thresholds before null routing your VM than your residential ISP would be wiling to tolerate.

Brute force on shell? SQL injection? Remote shell execution? Deploying the extra layer will not protect you from these as your own proxy will not give you WAF.

It is always important to know why you’re doing something, before anyone can prescribe a solution.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

You do not strictly need to open a port -- tunnelling through another server could be a solution, but let's park this for a moment.

What you are describing as "open a port in my firewall" is actually many smaller parts, some key ones that may be relevant are:

  1. (Firewall) Telling your gateway to not drop traffic when someone outside is request to connect to the specified port; and
  2. (Port Forwarding) Telling your gateway to forward traffic from that port to a specific computer's specific port within the network (i.e.: your computer, port 80)
  3. (Running a service) Having a service (say for example, a web server) running on the specified computer's specific port answering requests

All three things (amongst others that's not immediately relevant here) must be properly setup for any network request to happen. What do I mean by that? I can have a port not drop traffic (i.e.: firewall down). When someone from outside of my network trying to access the port, they'd get to my router, but nothing happens because there's no where for the packet to go. I can have my firewall down, and port forwarding enabled, but the web server isn't running. When someone from outside of my network trying to access the port, they'd get to my router, get forwarded to my computer, but because the web server isn't running, nothing happens. Someone from outside of my network can only gain access to my service (and only that service) only when all three are setup and working together.

"But what about the hackers?"

Yes, the untrusted networks, such as the internet, could be a bad place with people with bad intentions. There are many different things they could do to make things undesirable; let's explore some of them together.

Say we want to run an instance of Lemmy using a new experimental server software (i.e.: not the official Lemmy server). Now, unfortunately, some racist people decided to come and make racist posts on our instance. A tunnel / proxy doesn't solve this. Instead, we have to ban their accounts. It may not seem much, and it was completely innocuous to our system, but we've just dealt with our first attack.

One of those racist person happens to be the "scary hacker" type, so they came back and try to brute force our admin account's password to unban themselves. This is not too bad, but we need to address this somehow. A tunnel / proxy doesn't solve this; but something like Fail2Ban might be able to look at the login failures and put a temporary IP ban on the attacker.

They're back! And this time, they decide to repeatedly hammer the search function, thereby taking all the resources from our database, so our instance cannot serve other users. A tunnel / proxy doesn't solve this; but some rate limiting configurations in the server application might help.

They're not happy about getting rate limited there. So this time, they decided to continuously post garbage to our instance, not even normal requests, just connect to our web server, and spam AAAAAAAAAAAAAA..... non stop, at such a quick pace that it fully saturates our network connection, and we cannot do anything else on the network. A tunnel / proxy doesn't solve this; we'd need to block them from the firewall. This is not entirely true; blocking them at the firewall doesn't solve the problem, because the traffic still goes from the ISP to the firewall, which will still be saturated before the firewall could drop the traffic, but to use as an example it narrates a potential problem well enough.

They're angry now, and they pay a few bucks to botnets to have many many many thousands of infected computers to spam AAAAAAAAA... non stop at our service. Again, a tunnel / proxy doesn't solve this; we'd need to have something smarter than just our firewall and individually ban the IP addresses. This is where we'd need the professionals with typically commercial offerings.

It could escalade the other direction. Instead of attacking with aim to take the service down, they could do other damaging things. Say they found a problem with our server software. Instead of giving the /post/<postid> a numeric id, they can do something fancy like /post/1 AND 1 ==1; UPDATE users SET banned = FALSE WHERE username = 'racist-user' and unban themselves. A tunnel / proxy doesn't solve this; but a Web Application Firewall (WAF) might.

Now it escalades more. Through a complex chain of intentionally malformed image uploaded to the instance, the image resizer attempting to resize the image, which gets tripped over by the malicious image, which causes a remote code execution, which they use to create a remote access trojan (RAT) shell so they can connect to our server and run commands. This is usually the "big bad" that most people are scared of... someone from outside of their network having access to their system and thus gains the ability to extract their documents or encrypt their photos etc. A tunnel / proxy doesn't solve this; but a WAF or an anti-virus on the server itself might.

Through these albeit simplified but lengthy exploration, we see that none of these would actually be addressed by a tunnel / proxy. There are other possible attacks, and they'd require other solutions.

So, goes back to what I was saying earlier... it is important to know why you're trying to do something. Blindly prescribing tunnel / proxy doesn't actually solve the problem.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Say someone wants to take your service down, you've got 500Mbits line at home ISP, and 10Gbits on your VPS; they sends 1Gbits of traffic to your VPS, your VPS happily tries to forward 1Gbits, fully saturating your home ISP line. Now you're knocked offline.

Say someone discovers the actual IP, dropping traffic from anything else other than the VPS doesn't help if they just, again, flood your line with 500Mbits of traffic. The traffic still flows from the ISP to your gateway before they could be dropped.

Say someone wants to perform SQL injection on your website, there is no WAF in this stack to prevent that.

Say someone abuses a remote code execution bug from the application you're hosting in order to create a reverse shell to get into your system, this complex stack introduced doesn't protect that.

You've provided a comprehensive guide, and I don't want to single you out for being helpful, but I must ask: What problem does this solve, and does OP actually have the problem this stack can solve? From the replies we've seen in this thread, OP doesn't have sufficient understanding to the full scope of the situation. Prescribing a well intended solution might be helpful, but it gives a false sense of security that doesn't really help with the full picture.

Never buy .xyz

I just wanted to post this here because I want to help you all and hurt gen.xyz as much as possible. I had a .xyz domain through njal.la which I used to host jellyfin, homeassistant, and other basic things for friends and family. My domain recently became inaccessible without any notice. After a while of troubleshooting, I found...

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Locks can happen by registrar (I.e.: ninjala, cloudflare, namecheap etc.) or registry (I.e.: gen.xyz, identity digital, verisign, etc.).

Typically, registry locks cannot be resolved through your registrar, and the registrant may need to work with the registry to see about resolving the problem. This could be complicated with Whois privacy as you may not be considered the registrant of the domain.

In all cases, most registries do not take domain suspensions lightly, and generally tend to lock only on legal issues. Check your Whois record’s EPP status codes to get hints as to what may be happening.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

I think from a purely technical point of view, you’re not going to get FaceID kind of accuracy on theft prevention systems. Primarily because FaceID uses IR array scanning within arm’s reach from the user, whereas theft prevention is usually scanned from much further away. The distance makes it much harder to get the fidelity of data required for an accurate reading.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Given that the indices are not available locally, it’d be difficult for your own algorithm of any sort, AI or otherwise, to rank items higher/lower than others.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

So… just making sure I am understanding this properly: centralized service monopoly by one government backed provider…? Doesn’t that got quite a communist ring to it?

I guess it also makes it easier for the one government backed provider to require facial recognition for a centralized authoritarian policed state.

Oh, right, I forgot this is Lemmy, that’s exactly the goal of the vocal minority. Never mind. Carry on!

chiisana ,
@chiisana@lemmy.chiisana.net avatar

They’ll try to pull out of Apple Pay/Google Pay. At least that’s what Walmart did / is doing for the longest time in favor of their CurrenC or whatever thing in the US.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

At the end of the day, that’s just trading one spying conglomerate for another.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Vast majority of those who are vocal about “ownership” are from that reddit cult. They’ll drag you down to their level with nonsense and stupidity, trying to convince you that GameStop will make them multi-billionaires. Be careful and don’t waste too much of your time on them.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Same one about the retirement fund operator from Australia.

Problems with creating my own instance

I am currently trying to create my own Lemmy instance and am following the join-lemmy.org docker guide. But unfortunately docker compose up doesn't work with the default config and throw's a yaml: line 32: found character that cannot start any token error. Is there something I can do to fix this?...

chiisana ,
@chiisana@lemmy.chiisana.net avatar

If memory serves, the default docker compose expose the database port with a basic hard coded password, too. So imagine using the compose without reading too much, next thing you know you’re running a free Postgres database for the world.

Edit: yep, still publishing the db port with hard coded password…

chiisana ,
@chiisana@lemmy.chiisana.net avatar

BuyVM has $24s/yr KVM server that you can attach storage at $5/TB/mn. So 5TB should set you back $325/yr all in. They’ve been around for quite some time — I’ve been client since 2011 — so they’re not likely to disappear anytime soon.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

No multi-region unless you roll it yourself. Their offerings are primarily web hosting centric, so you’d need to do the heavy lifting yourself if you want more infra. Also worth noting that they're definitely not in the same league as the big players, they’re just an old vendor that isn’t likely to disappear on you.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

Siri was already behind the competition from its initial launch.

Apple Siri release date: October 4, 2011

Microsoft Cortana release date: April 2, 2014

Amazon Alexa release date: November 6, 2014

Google Assistant release date: May 18, 2016

Apple generally adopts technologies later than others so they could build on top of others learnings; things here was the exact opposite where they started years before others, and ended up paving the way to allow others to build better products based on their learnings.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • kbinchat
  • All magazines