[-] kristoff@infosec.pub 1 points 2 months ago

ah .. currently not available :-/

[-] kristoff@infosec.pub 2 points 2 months ago* (last edited 2 months ago)

Hum , interesting point. If you are a hacker, would you not prefer software to be spread out everywhere so people would be even more confused what is the real source for some application?

I guess people would then just depend on their search engine

[-] kristoff@infosec.pub 1 points 3 months ago

No apps at all ???

So it really is like a dumb terminal. Now I know why I never used a Chromebook😀

[-] kristoff@infosec.pub 1 points 3 months ago

Sounds like a money laundering sceme!

[-] kristoff@infosec.pub 1 points 3 months ago* (last edited 3 months ago)

As I mentioned earlier, I guess chrome is more like android where you have a much more strict seperation between the OS, applications and user data. (I remember reading about all the different partitions on android and what they are used for, but I should bruch up my knowledge on this).

Thanks for the additional into on brtfs! 👍

[-] kristoff@infosec.pub 1 points 3 months ago

Just watched some videos on btrfs. I start to understand the conceps. Perhaps I should also look into how exactly

On windows and the "recovery partion". I guess what you say is that it should always be possiblity to boot in some kind of system, but it will not happen automatically as there is no way for a system to detect that the system completely hangs.

Thinking about it. It kind of strange. Embedded systems have watchdog interrupts that get fired if the system hangs (i.e. if it does not provide a "yes, I still live" signal every "x" milliseconds). Does a PC not have something similar?

[-] kristoff@infosec.pub 1 points 3 months ago

just watched some videos on btrfs. Looks interesting indeed. I will look into it and perhaps do a test-installation and see how it goes.

Thanks for the info

[-] kristoff@infosec.pub 1 points 10 months ago

If you get your domain from OVH, you get one single mailbox (be it with a lot of aliases, like a different email-address for every service/website you use) for free.

[-] kristoff@infosec.pub 1 points 1 year ago* (last edited 1 year ago)

Is there a place where is explained what is exactly in the DMA (and DSA). I did find this video (be it quite high-level) interesting: https://www.youtube.com/watch?v=8y8BYI422NU&pp=ygURZHNhIGRtYSBleHBsYWluZWQ%3D

I have been wondering about this. Could the DMA (or DSA) be used to force google/youtube to allow users to disable the "this video might also interest you" (or simular) feeds from youtube, as this is (in my opinion) clearly aimed at creating addictive behaviour.

[-] kristoff@infosec.pub 1 points 1 year ago* (last edited 1 year ago)

Hi,

Good idea!

And once you have you domainname, you can do the following:

  • set up a reverse reverse proxy (apache, nginx) in front of nextcloud
  • in the configuration of apache/bginx use virtual hosts.
  • make sure that the default virtualhost (in apache, that is the the one that does not have "ServerName") first in the configuration. Point that to a local website with just an empty directory
  • then, AFTER the default virtual host, add the reverse-proxy configuration of your nextcloud instance.

What this does, is that if somebody addresses your website with a URL that does not contain the exact hostname of your nextcloud, the webquery will go to the empty website and simply return a 404. A hacker who does a webrequest to "https://your-ip-address/login" will just get a "404 not found" and not reach your nextcloud instance.

This keeps people who just scan the internet for vulnerable systems and try out all kind of URLs to try to get in out of your nextcloud.

Of course, this only works if you keep the full hostname of your instance to yourself and do not post it somewhere (including social media, mailing-lists, ...)

Good luck with your nextcloud server

[-] kristoff@infosec.pub 1 points 1 year ago* (last edited 1 year ago)

Hi Hugh,

To be clear. This is not about the tags itself. It's about the system of tag-following and how it is implemented on the fediverse. It is due to how the fediverse (acitivtypub) works and how (or why) messages are routed from one instance to another.

There is a major different on how following (people) and how tag-following work. (perhaps the simularity in name is not such a good choice)

The basic idea of following (people) is this: Consider that you are me are on a different instances and I want to follow you; so I hit the "follow" buttom.

What actually happens is this:

  • My instance sents an activitypub message to your instance. That message contains the information about me and you .. and that way, your instance is aware that I (on my instance) want to follow you (on your instance)
  • when you then write / boost / ... a post, your instance will then forward that post to my instance (based on the information received in step 1), which will then put it in my personal inbox stream.

So far, so good. I am happy to read your (very interesting) posts, and you are happy as your messages gets forwarded to a lot of people who think you are an awsome guy!

Tag-following however is based on a very different system.

  • you do a tag-follow request. What this does is that this tells your local instance that you are interested in all messages that contain the tag (say) "#caterday"

  • What this will do is this: If (in any way) a message enters your instance and that message contains the tag "caterday", your instance will drop a copy of that message in your inbox steam, .. which results in another post with a nice cat-image in your personal stream. Yeah!

  • What this does NOT do: Unlike the "following-people" system, tag-following is purely local thing. ("local" means "on your own instance"). So, what does NOT happen is that that your instance has started sending messages to all instances out there on the fedivere saying "hey .. here is somebody who is interested in cats .. please send me all these posts".

The main point here is that tag-following is only local between you and your own instance. Not more than then.

In essence, .. the important thing here is the first part of my message above: "If (in any way) a message enters your instance, and that message containts the tag ..."

So, then the question is: "what are the mechanisms so that a post enters an instance? (and -hence- be subject to tag-following)" This could happen in two ways:

  • because somebody local on the instance writes a post.
  • because somebody on a remote instance writes a post AND somebody on the local instances follows that person. As explained above, that message will get forwared by the remote host to your local instance.

So, to put things together, Consider we are on different instances, I write a post with the #caterday tag, .. but neither you or anybody else on your instance follows me, .. the video of my cat attacking a ball of cotton will NOT reach you. (bad luck for you ... you should have followed me :-p )

Does this mean that tag-following is useless? No, not at all.

When does tag-following work very well? To give a practicle example. I have an account on mastodon.radio (an specialised instance for amateur-radio) and overthere I do tag-following of #electronics.

That works very well because

  • there are a lot of ham-radio people doing electronics
  • there are also lot of people on other instances who are into building electronics .. but there is a very big chance that they are followed by at least one person on mastodon.radio. So their posts get forwarded to mastodon,radio ... which will then also appear in my inbox due to tag-following. This really works very well, and provides me with a good stream of messages with a good signal-to-noise ratio.

When does tag-following not work well?

  • if you have a personal instance as I also do.
  • if you are on a smaller instance and you have a less common interest. So, if you happen to be the only metalhead on (say) a 50 member instance that serves your local city, there is a very little chance that a tag-follow for your favorite all-female Japanese metal band will produce much content.

What can you do if you are in the 2nd senario?

If there exists an instance dedicated to your interest (that still accepts people)

  • get an account on that instance and use a multi-account app like fedilab

  • use an app like fedilab to remote-read the public feed of that instance, find interesting people, follow them with your current fediverse account you already have, and build up your list of interesting people to follow that way.

  • switch to lemmy or kbin :-) (as lemmy and kbin are by nature more community-based)

  • follow the lemmy/kbin community from within your mastodon/fediverse account.

If you happen to be interested in something very specific and the other nerds are all spread out over a zillion different fediverse instances out there:

  • use gup.pe

A nice exercise to get a good feeling about this is to get both an account on a mid-side instance and set up your own personal instance. The different in how to approach the fediverse become apparent quite fast.

Hope this helps :-)

[-] kristoff@infosec.pub 1 points 1 year ago

Hi, Correct. For you info. I co-manage a activity-pub relay for fediverse instances oriented towards hamradio. If you are interested in peering, feel free to send me a ping)

view more: ‹ prev next ›

kristoff

joined 1 year ago