Pika

You have correctly identified the core issue with open source.

Personally speaking, as inefficient as it is, I think that donations is the best way to support a self hosted open source project.

Followed by paying for licensing to be able to get support for the product.

If your project is open source any other restriction out there, you can’t really do because they can just fork and patch the software to remove the restriction.

Due to that restriction(or lack of), I’ve always personally seen most open-source projects to be more of a hobbyist or personal project then a project that someone wants to do to make money.

zabbix with ntfy for short term alerts and a telegram bot for long-term alerts.

This is such an embarrassment to this country, but regarding this administration, I’m not at all surprised.

I was originally going to add that usually different services can use the same name as long as there’s no overlap, but you can’t even use that on this one because they’re both blogging platforms.

Yeah, unless they have authorization from the original project this is likely going to require a name change.

Said backdoor isn’t possible with the current day key exchange process. Without the servers in use private key, the most law agencies can do without acquiring the private key is force the CA to revoke a cert, which will disallow properly configured clients from accessing and transferring data with the server.

LE doesn’t have enough information to recreate the private key based off the public key, the only key distributed during the CSR process is the servers public key via a certificate signing request which is signed using your private key, which the CA then signs with it’s own intermediate key (which is signed by it’s root server certificate) and hands back to the private server.

The CA doesn’t have the ability to create that private key, and as such doesn’t have a way to decrypt traffic that is using that key. There is no concern for a backdoor in that process.

In order for the “backdoor” to exist, they would need to either copy the private key as part of the signing process (which it doesn’t), or somehow force the server admin to use a new private key (that the CA also holds) or somehow compromise the servers key generation process to allow for an escrow on the private key when it was generated which would allow the CA to be able to recreate the private key using the master & public key.

Now don’t take me wrong, you can still have a MiTM impersonation attack or a full impersonation bypass by the CA issuing a new certificate and having the DNS registrar have the web address go to a new server that is using the new key but, that’s not something the CA alone has the capability of doing, and any traffic that is issued to the original server still wouldn’t be compromised, its just clients visiting your site will end up at the other site and as such will end up using keys that the other side generated instead of your own keys and additionally said new keys would also be appearing in Certificate transparency logs, or modern day clients would refuse to use them.

I don’t think anyone’s going to solve the problem in general, to be honest.

Like, Let’s Encrypts goal is super novel, but also expensive as shit to actually run, and requires a lot of coordination because it needs to be a trust authority. If this ever happened, it would probably be at the backing of some government structure, because I don’t see many people wanting to jump at that as an expense.

Is this accurate? Like, I know what you’re meaning, but I’m pretty sure it’s not ICANN doing it, and more so your domain registrar handing it over to the US government.

I think the most control that ICANN has over it is they could theoretically, if they wanted to, delete an entire top level domain. Since they do control the DNS root, but that is the most that they control from what I understand.

I don’t know if they have the ability to delete or transfer control over an individual domain on legal request. I think that’s outside of what their actual system allows for.

that’s interesting, I didn’t know that. Stupid design choices on so many pages suddenly make more sense.

I knew minetest had changed it’s name but, I thought it was something different than luanti for some reason.

I have to agree, its a pretty good game, I couldn’t get into how barebones it was last time I checked it out but, its been awhile so it seems that I need to add it to my need to try again list

I use proxmox on one server, but currently my layout is:

• docker 1:
  • Authentik first network
  • heimdall
  • immich
  • jellyfin
  • NPM first network
  • zipline
• docker 2:
  • authentik second network
  • npm second network
  • blorp
  • gitlab-runner
  • ladder
  • metube
  • photon
  • privatebin
  • tandoor
  • bar assistant
  • sponsor block

LXCS:

• database server
• pihole
• wireguard
• mail server (postfix/dovecot)
• zoneminder
• zabbix
• gitlab
• matrix
• xmpp/openfire
• revolt/stoat
• gamevox (temporary)
• pufferpanel - minecraft
• pufferpanel - ark
• palworld
• discord development container
• projects container

VMs:

• homeassistant
• ipa server
• firewall
• Syncthing / immich storage / PXE server/ File storage

Also thank you for making this post, it helped me realize I have a few containers and services I don’t use and I don’t think have activity on them anymore so I can start a deprecation cycle on them lol

I use proxmox on one server, but currently my layout is:

• docker 1:
  • Authentik first network
  • heimdall
  • immich
  • jellyfin
  • NPM first network
  • zipline
• docker 2:
  • authentik second network
  • npm second network
  • blorp
  • gitlab-runner
  • ladder
  • metube
  • photon
  • privatebin
  • tandoor
  • bar assistant
  • sponsor block

LXCS:

• pihole
• wireguard
• mail server (postfix/dovecot)
• zoneminder
• zabbix
• gitlab
• matrix
• xmpp/openfire
• revolt/stoat
• gamevox (temporary)
• pufferpanel - minecraft
• pufferpanel - ark
• palworld
• discord development container
• projects container VMs:
• homeassistant
• ipa server
• firewall
• Syncthing / immich storage / PXE server/ File storage

Also thank you for making this post, it helped me realize I have a few containers and services I don’t use and I don’t think have activity on them anymore so I can start a deprecation cycle on them lol

I’m too worried about config misconfigs to do that, I usually have a clean slate for /etc and then delete per user configs as I hit snags.

I think most other linux distros get the same treatment to be fair. I know I usually just nuke / and use the old /home

As someone who ran Ubuntu server for a few years before moving to Debian. I would recommend Debian over Ubuntu just because I have had to do less maintenance with it. When I was on Ubuntu updating it was a constant concern of “will something change that is bad” for example they pushed the kernel live patch and the Ubuntu subscription banner as an update instead of an upgrade, so I updated as normal, and there it was.

I dislike OS’s that install new packages as part of their update procedures (an update that installs a new package instead of replacing an existing one should be reserved for upgrades), and Debian has never done that with me, so Debian is where I stay.

it’s actually the recommended way if you use jellyfin, theres a few security/privacy vulnerabilities with publicly exposing the jellyfin server anyway, they are being worked on but, the safest way to do it is just use a vpn regardless.

Huh, TIL.

I’ve never knew that online mode turns skins off if you have the setting off. I guess it makes sense since it’s basically telling the server to not expect to have an external network/validate account, but still interesting.

I’ve only ever fiddled with having offline mode when I was running Geyser/floodgate to allow people on bedrock, but I think that must have a skin manager on it.

Ignoring cracks/illegal routes, I’m not sure you can

Microsoft deleted any remaining Minecraft accounts that were not migrated to a Microsoft account 2 years ago now. Any accounts remaining are now solidly Microsoft accounts with Minecraft access. Unless for some reason the android and apple license system was exempted, If you never ported your account, you no longer own a license to use Minecraft.

Its BS that they were allowed to do this but, that’s the state of the situation.

Any legitimate/legal launcher that you find for Minecraft is going to require you to sign into a Microsoft account to use it, as they require account authentication to download the library files and the old Mojang account system that the original system used no longer exists.

you mentioned PovavLauncher. That’s a minecraft launcher as well, they don’t provide libraries for the game, and instead have you sign into a MS account so they can pull the files directly from microsoft.

edit: Apparently the requirement to have an account to download the files isn’t actually correct. It’s just they require you to have a license to use Minecraft if you’re going to download them. I don’t feel like it was always this way but it currently seems to be that way with my testing.

Sorry, make legal requires the lawyer subroutine which requires full access to everything to verify you have the money to be able to make such a claim

my first go to for fixing every issue I have with a windows component

1. sfc /scannow
2. dism /online /cleanup-image /restorehealth

the amount of time that last command has fixed a core issue with the system is shocking but god that command takes forever

I’m more surprised that your school doesn’t go by the “Wipe and reimage” policy. Most every school now uses some form of cloud service. No reason to spend time troubleshooting when you can just do a stock image and have the student sign in again