• 0 Posts
  • 50 Comments
Joined 1 year ago
cake
Cake day: August 18th, 2023

help-circle


  • My solution for this type of situation is MicroBin running on my home network from a non-standard port, with a port knocker to open and close the port when needed.

    My router handle DDNS so I can always contact my home network easily. I port-knock to trigger an iptables command on the router to forward traffic to the MicroBin host.

    I also have my phone set up to connect via openvpn to my home network so that I can remotely do things like start and stop services, set port forwarding rules, etc.


  • neatchee@lemmy.worldtoSelfhosted@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    9
    ·
    edit-2
    3 months ago

    Oh boy, let’s take this piece by piece…

    DISCLAIMER: I AM NOT A LAWYER AND THIS IS NOT LEGAL ADVICE

    First: let’s talk about the difference between copyright, patents, and trademark

    A patent protects a method of doing something - like a novel piece of code, or a newly invented drug formula - from being duplicated and used or sold without your consent.

    Copyright protects creative works - like art, books, and computer software - from being mimiced. It literally deals with the rights to copy something

    Trademark protects brands - like a logo or company name - from being used by other people for profit. It usually deals with marketplace confusion, as when someone creates a competing product with a similar logo to try to benefit from the logo’s recognition and popularity.

    So, with that said, what are YOU dealing with?

    Well, since you’re not selling software or utilizing anything from the WatchDogs game universe, you’re pretty much free and clear on both patent and copyright.

    What about trademark?

    Well, on the one hand, you are not competing with Ubisoft in any way, nor are you attempting to represent yourself as related to WatchDogs. So, by the letter of the law (in the US), they don’t have a valid complaint.

    However, trademark under US law has this funny feature where an entity that holds a trademark is required to vigorously defend it when they become aware of potential infringement. This is to prevent the selective application of trademark. That is, if I know John is using my trademark and I don’t go after him, then Steve uses my trademark too, I can’t suddenly claim to have an interest in defending it when I didn’t care before. Steve can point at the fact that I didn’t go after John and say “you already gave up your trademark by failing to enforce it”.

    So how does this impact you? Well, unfortunately, even if you are technically allowed to use “dedsec” under US law, if Ubisoft has a trademark on the term “dedsec” specifically, AND if someone at Ubisoft became aware of your use of their trademark, they would likely come after you for trademark infringement just to cover their ass. You might even win in court, but it would cost a whole lot of money that you would likely never be able to recover.

    The good news is that the very first step in a trademark dispute is a cease and desist letter. They’ll demand you stop using their trademark. At that point you can either comply, refuse, or offer to settle the matter by selling them the domain.

    What you do with this information is up to you.


  • Troll mode: Rip the first 5 minutes of each movie then splice in Rick Astley

    Troll activist mode: Rip the first 5 minutes of each movie then splice in Richard Dawkins’ The God Delusion live reading

    Troll comedian mode: Rip the first 5 minutes of each movie then splice in Monty Python’s The Life of Brian

    Activist mode: Find a set of movies to rename that teach about the harm religion has caused

    Ethical absolutist mode: Refuse to host them, and explain why

    Non-confrontational familial support mode: Give Mom a unique user and make the god movies only accessible to that user

    In all seriousness it depends on what your priorities are. Is it more important to you to provide judgement-free support to your mom so she knows she can rely on you, or is it more important to try to reduce harm in the world by deplatforming harmful media? Or maybe it’s more important to try to teach your mom what’s wrong with those movies and you can come to an arrangement where she can watch those movies only if she agrees to watch movies you choose in equal amounts (since you can track it) to counteract the propaganda?

    What is most important to you?


  • That’s a non-trivial number of devices, so I would recommend a decent router that will last into the future, including service upgrades. Especially if anyone in the house is gaming and streaming movies at the same time

    I recommend purchasing the modem and router as two separate units.

    For the modem, because you have symmetric gigabit service, you’ll need one that supports gigabit upstream. That means the less expensive SB8200 is out. Instead, you’re looking at the ARRIS SURFboard S33. You can also find a comparable product from Netgear, the CM2000

    For your router, I personally like and trust Asus. Their user interface is robust but user-friendly, and their firmware is well supported by the home networking community (including a stellar ‘expanded’ version called AsusMerlin that frequently has features pulled into the official firmware)

    While you could go with an older model that only supports WiFi 5 (AC), those models have reached end-of-life and will only receive critical security updates. Instead, it’s worth spending a bit more for the WiFi 6 (AX) version.

    The minimum you’ll want to support a symmetric gigabit connection like what you have is the Asus RT-AX86U. However, to support possible higher speeds in the future, and to get the most rock-solid performance, I recommend the Asus RT-AX88U. This is what I personally own for my symmetric gigabit connection

    NOTE: There are older versions with the same model number that have extra LAN Ethernet ports (8 total) and no 2.5Gbps port. Do NOT get them! There are known issues when using ports 5-8 on these units

    Again, you could find a similar product in the Netgear Nighthawk brand.

    Anything above that is going to be extra bells and whistles. Things like extra WiFi bands, stronger radios, more 2.5Gbps ports, support for link aggregation, and some one-click gaming features that I personally think aren’t worth the money.

    Depending on the size of your home and your personal use case, you may also find value in adding mesh WiFi nodes to your network. Asus and Netgear both have their own implementations here. Asus’ version is called AiMesh and is pretty seamless. All of their modern routers can act as the primary mesh node.

    Personally I do not game on WiFi, so I went with 3x Asus ZenWiFi AX Mini (XD4) mesh nodes. They can be connected wirelessly to the main router, or by Ethernet to reduce latency. If I were going to be gaming on WiFi, I would have gone with the beefier ZenWiFi AX (XT8) nodes instead

    Hope that helps, and let me know if you have any questions! Happy to go into more detail on whatever you need


  • Based on your edit, what you need isn’t MoCA. What you need is a cable modem and a router (preferably as separate units, not a combo one like you have. Happy to explain why if you care)

    • What is your ISP?

    • What is your current advertised upload and download speed for the internet plan you have?

    • Do you get TV or phone service through the same provider?

    • Is your house wired for Ethernet? Coax? Both?

    • How many people live with you?

    • How many sqft is your home?

    • How many devices well be connected? How many are wired? How many on WiFi?

    • What is your use-case? Simultaneous streaming in 4k and latency-sensitive gaming? Mostly non-competitive gaming? Big downloads? Do you plan to stream content from your home while traveling or similar?

    Help me help you :p


  • Just to make absolutely sure: you are POSITIVE that the device you’ve been renting is a MoCA-WAN router, and NOT a cable modem?

    In the US at least, most of the single-unit devices that receive a coax input are DOCSIS 3.x, not MoCA. They are combining two pieces of hardware in a single physical unit: a docsis modem and a router.

    Prior to having fiber internet, when my provider was Comcast, I owned two separate devices instead of renting the single device from my ISP: a DOCSIS 3.1 modem from Arris, and a standard Ethernet router

    Just want to make sure you are absolutely confident about what your ISP is actually providing before you spend money on new hardware :)



  • While you may be correct, that was my experience. As a new user, I joined two Lemmy instances, was unsatisfied with the full feed on both, and said “screw it, I’m going to the biggest server”.

    The problem with telling people they can fetch the missing comms are threefold:

    1. It becomes a perpetual maintenance task. New communities are being created all the time and I don’t want to have to reference other servers’ feeds regularly to stay up to date on the newest stuff. I might as well just be on that other server

    2. Part of the joy of the firehose is seeing when some completely obscure community has a wildly popular post that one time because it’s extra funny or shocking or whatever. Those posts just won’t make it to most smaller servers.

    3. It’s an “unknown unknowns” problem. Sometimes you know what it is that you don’t know and can go find it. But often I don’t know which things I don’t know, so I can’t seek it out to add to my server. The beauty of a big server is that I don’t have to do that legwork or even think about it.

    All it takes is one user on the server subscribing to the Western Spotted Bull Frogs community for me to see it when they have a post blow up. The chances of one such user being on my server go way up here on lemmy.world. I’m sure there are smaller servers that are “good enough” in that regard. But why would I bother when I have what I want right here?

    Not trying to be argumentative, just calling out what I see as a fundamental truth about Lemmy, compared to other fediverse applications. Like, on mastodon a big server’s fedirated feed is more or less unreadable. That makes smaller servers appealing as it helps prioritize what makes it into the feed. On Lemmy, the voting system does that prioritization, removing one of the big reasons to avoid larger servers in the first place :)


  • I tried a smaller Lemmy server first and it didn’t meet my needs.

    I used reddit in two specific but different ways:

    1. About a dozen subreddits that I would visit individually. Small Lemmy instances work fine for this. Just subscribe to the ones I care about

    2. Browsing r/all, taking in whatever was popular at any given moment. This only works on big Lemmy instances with wildly diverse federation.

    I love the firehose of “what bizarre things bubbled to the top today? Oh snap, there’s a scandal in the professional bowling community. This Farscape meme is hilarious even without context. Wow, look at that crazy picture of an owl riding another owl riding a bear” or whatever.

    There was never enough content on small Lemmy servers to satisfy that itch. But scrolling the main feed on lemmy.world is good enough


  • There is no question that most myths and legends were originally an attempt to convey facts, theories, or guesses into the future.

    Humans are built to be pattern matching machines and prediction engines; it’s one of the big survival traits we developed through evolution and we’re better at it than any other species we know of.

    BUT objectively speaking we were still really, really bad at it. Yet that doesn’t stop us from trying.

    So we tend to do the best we can with the information we have available at the time.

    As others have said, “physics” - and science in general - is by definition immutable. It is the thing that can be tested with specific predictions that always turn out to be correct. If I can perform an experiment today, and you can perform the same experiment 100 years from now, and (adjusting for environmental factors and measurement accuracy) we get the same results, and we can repeat that over and over, that’s science.

    But our understanding, our knowledge of it, can change as you say. That doesn’t make physics less true, it just make our knowledge of and ability to describe physics less accurate.

    We can trace so many stories - including modern religions - to origins that attempt to explain our limited observations in the past. They were our best effort at matching patterns and predicting outcomes in the world around us. And the inaccuracies, the limitations don’t mean we should stop believing the things we think we understand today.

    It just means that we must recognize new information when it arrives as testable data, and incorporate it into our current understanding, relegating the wisdom of the past to history.



  • Here’s how it was intended to work:

    • debian, fedora, or another RPM-based distribution updates references to liblzma to 5.6.x in their latest release
    • the package repository is updated (usually through automation) by getting the infected tarball and compiling it into an RPM or DEB which is added to the repo
    • if the package is built using glibc and the gnu linker, and for a system that uses systemd, the exploit is enabled during compilation of the x86-64 version of the package; otherwise the result is normal
    • when an application is installed that depends on liblzma, possibly during OS installation itself, the infected RPM/DEB package from the package repository is downloaded and installed (assuming the system matches the requirements above)
    • in this particular case, OpenSSH was the primary target; if the attacker wanted to, it could have targeted any web-facing service that uses liblzma such as OpenSSL + Apache/nginx, etc
    • when the OpenSSH server is started on an infected system, it loads the infected liblzma binary
    • the attacker starts an SSH connection to the infected server, having already known about the server or by scanning the internet for visible ssh servers
    • during creation of the SSH connection, the user has the option of trying to sign in using an RSA key. The attacker uses a specially formed RSA key only available to the attacker that also contains a chunk of code (the “payload”) that they want executed on the server
    • liblzma is utilized to compress data in transit; when the infected liblzma decompresses the RSA key on the server, the exploit recognizes the attacker’s special RSA key and executes the payload on the host system. Otherwise, the ssh session continues as normal

    This would not impact MacOS because you couldnt install the infected package, since it is only ever built for debian or RPM-based systems running systemd, using glibc and the gnu linker, and for x86-64. Unless I’m misunderstanding something, there is no way to get the compiled binaries that are infected to work on a MacOS system

    Additionally, I should note that I’m not exactly an expert on this stuff; I’m just in the security space and have been reading about this as it happens, so it’s possible there are errors in my understanding. But that should at least give you the gist of the attack


  • Quick summary:

    • only impacts Debian and Linux distributions that utilize RPM for packages
    • only impacts cases where liblzma is compiled from a tarball, rather than cloned source repository or precompiled binary
    • only impacts x64 architecture
    • introduced in liblzma 5.6.0 which was released in late February so only impacts installs receiving updates to liblzma since then

    liblzma is a library for the lzma compression format. Loosely, this means it’s used by various other pieces of software that need this type of compression, rather than being an application itself.

    It is very widely used. It comes installed on most major Linux distributions and is used by software like openssh, one of the standard remote connection packages.

    However, since it was only in the tarball, you wouldn’t see it widely until debian, fedora, et al release a new version that includes the latest liblzma updates. This version hadn’t been added to any of the stable release channels yet, so the typical user wouldn’t have gotten it yet.

    I believe this would have gone out in debian 12.6 next week, and the attacker was actively petitioning fedora maintainers to get it added to fedora 40 & 41

    The interesting thing about this situation was how much effort the attacker put in to gain trust just to get to the point where they could do this, and how targeted the vulnerability seems to have been. They tried very hard to reduce the likelihood of being caught by only hitting a limited set of configurations




  • Yeah, so, Google already has this data about you. What they’re doing here is trying to reduce the specificity of information given to advertisers about your behaviors, and simultaneously give you the ability to never inform specific third parties about your interest in the specific topics you choose

    I see this as a good thing. They were literally already getting and using all of this data. In that case I’d much rather have some control over who knows which things about me, rather than leaving it entirely up to Google



  • Ok this is a super fascinating intersection of American social history

    So the first thing you have to always keep in mind when thinking about Americans and their behavior is that the country was founded by people so absurdly religious that the British kicked them out. Then, along with some wealthy land owners, they said “fuck off” right back to the crown, declared “no take-backs”, and went on about 100 years of aggressive westward expansion.

    If you’re not familiar with the phrase “manifest destiny” it’s worth looking up. It’s fundamental to American society

    Fast forward a bit to post-WWII and the economic boom of the time. “The American Dream” - and the promise to our returning soldiers - was owning your own house with a yard, wife, kids, dog, and a car. And given our history, and the return of thousands and thousands of young men from the war, that kinda became the measuring stick of basic success: moving out.

    And of course since America is the land of opportunity, if you can’t do even that much, you’ve only got yourself to blame /s

    We all know the meme of “striking out on your own” as a symbol of maturity. This is just what happens when “striking out on your own” becomes a cultural identity