On a server, it allows you to track who initiates which root season session. It also greatly minimizes the attack surface from a security perspective to have admin privileged accounts unable to be remotely connected to.
Separate ssh keys for the user and the admin? Yeah, see point 2, admins should not be remotely accessible.
Really? How, exactly? Break the ssh key authentication? And wouldn’t that apply to all accounts equally?
Keys aren't perfect security. They can easily be mishandled, sometimes getting published to GitHub, copied to USB drives which can easily be lost, etc.
Further, there have been attacks against SSH that let malicious actors connect remotely to any session, or take over existing sessions. By not allowing remote access on privileged accounts, you minimize risk.
Forcing a non privileged remote session to authenticate with a password establishes a second factor of security that is different from the first. This means a cracked password or a lost key is still not enough for a malicious actor to accomplish administrative privileges.
A key is something you have
A password is something you know
So, by not allowing remote privileged sessions, we're forcing a malicious actor to take one more non-trivial step before arriving at their goals. A step that will likely be fairly obvious in logs on a monitored machine.
I strongly disagree with your premise. Separating authentication and privilege escalation adds layers of security that are non-trivial and greatly enhance resilience. Many attacks are detected and stopped at privilege escalation, because it happens locally before a user can stop or delete the flow of logs.
If I get into your non-privileged account I can set up a program that acts like sudo
No you cannot. A non privileged user doesn't have the access necessary to run a program that can accomplish this.
And even if they do it’s too late anyway because I’ve just compromised root and locked everybody out and I’m in there shitting on the filesystems or whatever. Because root can do anything.
Once again, you didn't privilege escalate, because once you have a foothold (authentication) you don't have the necessary privileges, so you must perform reconnaissance to identify an exploitable vector to privilage escalate with. This can be any number of things, but it's always noisy and slow, usually easy to detect in logs. There is a reason the most sophisticated attacks against well protected targets are "low and slow".
And if I can’t break into your non-privileged account then I can’t break into a privileged account either.
You're ignoring my points given regarding the risks of compromised keys. If there are no admin keys, there are no remote admin sessions.
These artificial distinctions between “non-privileged” and “superuser” accounts need to stop. This is not good security, this is not zero trust. Either you don’t trust anybody and enforce explicit privilege escalation for specific things, or just accept that you’re using a “super” paradigm and once you’ve got access to that user all bets are off.
Spoken like someone who has never red teamed or purple teamed. Even admin accounts are untrusted, given only privileges specific to their role, and closely monitored. That doesn't mean they should have valid security measures thrown away.
That's called 'privilege escalation', and replacing system level calls with user level calls is closely watched for and guarded against with many different security measures including SELinux.
You've already outed yourself multiple times in this thread as someone who doesn't understand how security in the real world works. Take the L and try to learn from this. It's okay not to understand something. But it's very important to recognize when that happens and not claim to understand better than someone else.
They even literally have a section of the article that says they "see Fair Software as an alternative model to the free and open source software model", and they think it's superior because the "developers can profit".
Newsflash: the developers usually see fractions of those cents while most of the money goes to the management and shareholders of the company that employs them. Hmm, doesn't seem fair to me.
Also, developers can and do profit from FOSS in many ways, but the most popular models are with commercial support, SaaS offerings, and additional functionality (like providing a web interface, clustering manager or other external piece of the puzzle to solve the problem at scale in enterprise).
Like you said so succinctly: propaganda website to make rug pullers like Elastic and Hashicorp look better.
I cannot stand google news any more, too much spam, clickbait and advertisement. So I decided to try to selfhost an RSS aggregator to make myself a news feed that I would be comfortable with. Being RSS such an "ancient" thing I thought there will be many mature systems, but I'm not sure that's the case.....
I use FreshRSS. Can't say I love the interface, but with the open and standardized API, there are dozens of beautiful front ends to choose on any device.
No no you don't understand. The evil corporate overlords abused their power to force a choice on a developer, even though that choice was objectively the right choice and the developer was throwing a tantrum.
This is truly awful. We must not let evil corporations, no matter their credentials, expertise, and decades of beneficial partnership with open source, tell immature and short sighted developers how to develop.
Accurate, but not bad, yes. It turns out standardized base systems and ABIs are important to an ecosystem.
Linux tried the disorganized free-for-all for two decades, and what we got was fragmented "Ubuntu admins", "debian admins", "redhat admins", "suse admins", and a whole shitload of duplicated effort in the packaging ecosystem, only for half the packages out there to be locked to Ubuntu or RHEL. So the corporate interests, and a fair number of the community efforts, centralized their problems and solutions into a small standardized suite in Mesa+Wayland+systemd+Pipewire+flatpak, etc
The result is a ton more interoperability, a truly open ecosystem where switching your distro doesn't mean hiring different people and using different software, and a lot more stability and maturity.
And hey, if a user or distro wants to do their own thing, they can make and own their niche, same as before. Nothing lost.
It's been kind of wild to watch over the past 15 years or so, makes me very hopeful for the next 15.
Upgrade went mostly without a problem (had set more than one Hostname for a service before, seems to not work anymore lol), and i have a pretty large configuration that has grown over the past two years....
“We had a huge chunk of our engineering staff spending time improving FreeBSD as opposed to working on features and functionalities. What’s happened now with the transition to having a Debian basis, the people I used to have 90 percent of their time working on FreeBSD, they’re working on ZFS features now … That’s what I want to see; value add for everybody versus sitting around, implementing something Linux had a years ago. And trying to maintain or backport, or just deal with something that you just didn’t get out of box on FreeBSD.”
I still hold much love for FreeBSD, but this is very much indicative of my experience with it as well. The tooling in FreeBSD, specifically dtrace, bhyve, jails, and zfs was absolutely killer while Linux was still experiencing teething problems with a nonstandard myriad of half developed and documented tools. But Linux has since then matured, adopted, and standardized. And the strength of the community is second to none.
If you're trying to use it as a workstation or a laptop, you won't find much compelling. It's built with the intent to act as a server. In fact, as a web server or networking server it's second to none.
Administrating BSD is lovely. It's well documented and everything is very stable, understandable, and predictable.
I was actually surprised to find out QUIC is fairly close to being default.
Wikipedia
HTTP/3 uses QUIC, a multiplexed transport protocol built on UDP.
HTTP/3 is (at least partially) supported by 97% of tracked web browser installations (thereof of 98% of "tracked mobile" web browsers), and 29% of the top 10 million websites.
Never ask a man his pay, a woman her weight, or a data horder the contents of their stash.
Jk. Mostly.
I have a similar-ish set up to @Davel23 , I have a couple of cool use cases.
I seed the last 5 arch and opensuse (a few different flavors) ISOs at all times
I run an ArchiveBot for archive.org
I scan nontrivial mail (the paper kind) and store it in docspell for later OCR searches, tax purposes etc.
I help keep Sci-Hub healthy
I host several services for de-googling, including Nextcloud, Blocky, Immich, and Searxng
I run Navidrome, that has mostly (and hopefully will soon completely) replace Spotify for my family.
I run Plex (hoping to move to Jellyfin sometime, but there's inertial resistance to that) that has completely replaced Disney streaming, Netflix streaming, etc for me and my extended family.
I host backups for my family and close friends with an S3 and WebDAV backup target
I run 4x14TB, 2x8TB, 2x4TB, all from serverpartsdeals, in a ZFS RAID10 with two 1TB cache dives, so half of the spinning rust usable at ~35TB, and right now I'm at 62% utilization. I usually expand at about 85%
Medium mode is a fun challenge at first, eventually becoming fairly chill as you advance in skill and confidence.
Hard mode is always fairly hard, especially on harder maps.
There are many resources to manage, but none that feel burdensome.
The game is extremely thematic, it feels alive with charm.
Graphics are excellent, though sometimes graphical glitches can still be encountered.
The water. It's so hard to explain to someone who hasn't encountered this system before, but water is life in this game, and it's both beautiful graphically, and extremely well simulated by physics. Learning to control the water, and see the shortest paths to end water scarcity with beaver engineering is an amazingly fun and unique aspect of the game.
Mods are well supported and the community is vibrant.
Cons:
Not a ton of content. They've been very good about adding new mechanics (badwater, extract, etc) but there's still just 2 races of beaver and a dozen or so maps.
No directed experience. In similar games I've enjoyed a campaign, challenge maps/scenarios, weekly challenges, a deeper progression system, just... Something to optionally set your goals. There's nothing of the sort in the vanilla game. It's fully open ended and there's only one unlock outside of your progress though the resource tree in a map.
All in all, I highly recommend it, especially at the modest asking price. If you love city builders, charming and beautiful art, thematic settings, dynamic challenge, and solution engineering, this is a fantastic game for you.
Other games I've enjoyed that scratch similar itches:
KSP
Cities: Skylines (but Timberborn has been far more compelling)
Factorio
Mindustry
Planet Zoo (Timberborn has less of a directed experience, but is otherwise completely superior)
Gnomoria
Banished
Tropico series (though I view this as more casual)
“While no one predicted this specific outcome, we shouldn’t be surprised,” added the investor Benaich. “If antitrust regulators make [mergers and acquisitions] prohibitively difficult, we should expect these bizarre semi-exits to become more common.”
Seriously. This guy thinks that regulators would have stepped in to stop OpenAI or Microsoft from acquiring a no-name 2 year old startup with two rounds of funding?
I'm in a bit of a productivity rut and whilst I suspect the issue is mainly between the keyboard and chair I'm also interested in what (FOSS) tools there are that people find effective....
In my experience, nope. I tried so hard to use Logseq, but I had massive issues with speed, stability, and database corruption.
Really I think the root of the issue is their database. The database causes so many problems and makes their synchronization methods dirty hacks at best.
Obsidian for a second brain based on the molecular notes method. And yes, I've tried all of the FOSS alternatives. None are ready to replace Obsidian yet.
Wallabag for saving resources offline for easy and permanent reference.
Lunarvim for actually sitting down to work instead of fiddling with and optimizing my setup.
[Thread, post or comment was deleted by the moderator]
A year ago I set up Ubuntu server with 3 ZFS pools on my server, normally I don't make copies of very large files but today I was making a copy of a ~30GB directory and I saw in rsync that the transfer doesn't exceed 3mb/s (cp is also very slow)....
ZFS is a very robust choice for a NAS. Many people, myself included, as well as hundreds of businesses across the globe, have used ZFS at scale for over a decade.
Attack the problem. Check your system logs, htop, zpool status.
When was the last time you ran a zpool scrub? Is there a scrub, or other zfs operation in progress? How many snapshots do you have? How much RAM vs disk space? Are you using ZFS deduplication? Compression?
Yeah, you should be scrubbing weekly or monthly, depending on how often you are using the data. Scrub basically touches each file and checks the checksums and fixes any errors it finds proactively. Basically preventative maintenance. https://manpages.ubuntu.com/manpages/jammy/man8/zpool-scrub.8.html
Set that up in a cron job and check zpool status periodically.
No dedup is good. LZ4 compression is good. RAM to disk ratio is generous.
Check your disk's sector size and vdev ashift. On modern multi-TB HDDs you generally have a block size of 4k and want ashift=12. This being set improperly can lead to massive write amplification which will hurt throughput. https://www.high-availability.com/docs/ZFS-Tuning-Guide/
How about snapshots? Do you have a bunch of old ones? I highly recommend setting up a snapshot manager to prune snapshots to just a working set (monthly keep 1-2, weekly keep 4, daily keep 6 etc) https://github.com/jimsalterjrs/sanoid
And to parrot another insightful comment, I also recommend checking the disk health with SMART tests. In ZFS as a drive begins to fail the pool will get much slower as it constantly repairs the errors.
Just saw on Titus Tech Talk that torrents are last decade, and newsgroups is where it's at for this stuff. Of course he didn't elaborate, so I need some help here....
A university near me must be going through a hardware refresh, because they've recently been auctioning off a bunch of ~5 year old desktops at extremely low prices. The only problem is that you can't buy just one or two. All the auction lots are batches of 10-30 units....
I almost feel like it's October last year, when I pled for improvement on all fronts regarding the Kbin development strategy. Now it seems development has ceased once again and there hasn't been chat on the matrix channels for over a week. Update: that's two weeks now (including his blog) and over a month of no visible...
He did though. And honestly the website has come very far in a short period of time, I really don't understand the concerns and whining in this thread...
Why do you assume that? Why is your way of open source the right way?
All open source projects are run by a small team of people reviewing and accepting, rejecting, and prioritizing work. What part of this project's methodology bothers you?
Development is happening in the dev's branches. Branches are generally kept local until submitted for a PR. You can easily see this in the origin branches and open PRs.
Honestly I'm not sure if you're trolling, don't understand git development, or if you really think that a project needs to iterate main multiple times per month to be your definition of "healthy open source", but I'm tired of shooting down such lazy attacks and won't be responding further.
Currently working on a replacement for BirdCAGE. It was a pretty cool project, that was unfortunately based on some pretty hacky code (not the dev's fault, he based it on BirdNet-Pi) and subsequently has been abandoned.
MVP is up and running, just polishing and adding features. Still no GUI just yet, right now it's just presisting the data locally (recordings with detections, spectrograms, and a database of detections) and submitting the results to Birdweather which you can use as a basic UI until I get around to it.
I absolutely love how thoughtful the dev's of this game are. You can tell they pick apart every detail and make sure it works as a whole. Nothing feels out of place or incomplete.
Ubuntu seems like it has the best compatibility, but any other suggestions for data wrangling, data analysis, data visualization, and machine learning in Julia, Python and R?
Anyone done this? Got a set of repeatable instructions? My understanding is that the root docker image needs to switch from alpine to ubuntu and that hasn’t happened yet.
You're talking about two very different technologies though, but both are confusingly called "AI" by overzealous marketing departments. The basic language recognition and regressive model algorithms they ship today are "Machine Learning", and fairly simple machine learning at that. This is generally the kind of thing we're running on simple CPUs in realtime, so long as the model is optimized and pre-trained. What we're talking about here is a Large Language Model, a form of neural network, the kind of thing that generally brings datacenter GPUs to their knees and generally has hundreds of parameters being processed by tens of thousands of worker neurons in hundreds of sequential layers.
It sounds like they've managed to simplify the network's complexity and have done some tricks with caching while still keeping fair performance and accuracy. Not earth shaking, but a good trick.
Hard disagree on them being the same thing. LLMs are an entirely different beast from traditional machine learning models. The architecture and logic are worlds apart.
Machine Learning models are "just"statistics. Powerful, yes. And with tons of useful applications, but really just statistics, generally using just 1 to 10 variables in useful models to predict a handful of other variables.
LLMs are an entirely different thing, built using word vector matrices with hundreds or even thousands of variables, which are then fed into dozens or hundreds of layers of algorithms that each modify the matrix slightly, adding context and nudging the word vectors towards new outcomes.
Think of it like this: a word is given a massive chain of numbers to represent both the word and the "thoughts" associated with it, like the subject, tense, location, etc. This let's the model do math like: Budapest + Rome = Constantinople.
The only thing they share in common is that the computer gives you new insights.
Systemd Looks to Replace sudo with run0 ( news.itsfoss.com )
TIL: FairCode is the software model Redis, ElasticSearch, etc. use ( faircode.io )
Fair-code is not a software license. It describes a software model where software:...
Which RSS aggregator do you use? I cannot seem to find one that works for me.
I cannot stand google news any more, too much spam, clickbait and advertisement. So I decided to try to selfhost an RSS aggregator to make myself a news feed that I would be comfortable with. Being RSS such an "ancient" thing I thought there will be many mature systems, but I'm not sure that's the case.....
Freenginx: A Fork of NGINX ( thenewstack.io )
systemd Rolling Out "run0" As sudo Alternative ( www.phoronix.com )
Traefik 3.0 GA Has Landed: Here's How to Migrate ( traefik.io )
Upgrade went mostly without a problem (had set more than one Hostname for a service before, seems to not work anymore lol), and i have a pretty large configuration that has grown over the past two years....
No one is being ‘marooned’ by Debian focus - TrueNAS ( blocksandfiles.com )
Which communication protocol or open standard in software do you wish was more common or used more?
Whether you're really passionate about RPC, MQTT, Matrix or wayland, tell us more about the protocols or open standards you have strong opinions on!
12TB for $80 - serverpartdeals.com ( serverpartdeals.com )
Has anyone bought from here before? Looking to upgrade my NAS drives.
What lesser known free and open source software do you use daily to improve your life?
For me it is the note taking/PKMS tool SilverBullet.
Thoughts on the game Timberborn ( store.steampowered.com )
Has anybody given this game a try? I've been considering it for a while, but money is tight. Curious if it was worth it....
AI unicorn Inflection abandons its ChatGPT challenger as CEO Mustafa Suleyman joins Microsoft ( www.forbes.com.au )
“While no one predicted this specific outcome, we shouldn’t be surprised,” added the investor Benaich. “If antitrust regulators make [mergers and acquisitions] prohibitively difficult, we should expect these bizarre semi-exits to become more common.”
Fanless linux laptop
I'm looking for an Apple MacBook Air M2 alternative that could run Linux....
What's your favorite terminal?
I'm looking for a new terminal. What's your favorite one and why? Which one is popular?
Reddit has never turned a profit in nearly 20 years, but it just filed to go public anyway ( edition.cnn.com )
Spam posts
So what can we do to combat this Spam posting as a community? Anyone have any ideas?
Recommend me some Quality of Life Android applications
the title says it all 😀
Second hand disks? ( www.ebay.ca )
What do you think about buying second hand disks and using higher redundancy?...
What Linux "Productivity" (ideally FOSS) tools do you use?
I'm in a bit of a productivity rut and whilst I suspect the issue is mainly between the keyboard and chair I'm also interested in what (FOSS) tools there are that people find effective....
[Thread, post or comment was deleted by the moderator]
Best Filesystem for NAS?
A year ago I set up Ubuntu server with 3 ZFS pools on my server, normally I don't make copies of very large files but today I was making a copy of a ~30GB directory and I saw in rsync that the transfer doesn't exceed 3mb/s (cp is also very slow)....
Newsgroups?
Just saw on Titus Tech Talk that torrents are last decade, and newsgroups is where it's at for this stuff. Of course he didn't elaborate, so I need some help here....
Has anyone here built a Beowulf Cluster? ( spinoff.nasa.gov )
A university near me must be going through a hardware refresh, because they've recently been auctioning off a bunch of ~5 year old desktops at extremely low prices. The only problem is that you can't buy just one or two. All the auction lots are batches of 10-30 units....
audiobook app?
Im looking for an app for android that allows streaming audio books, downloads ect....
What is going on with Kbin ( kbin.melroy.org )
I almost feel like it's October last year, when I pled for improvement on all fronts regarding the Kbin development strategy. Now it seems development has ceased once again and there hasn't been chat on the matrix channels for over a week. Update: that's two weeks now (including his blog) and over a month of no visible...
Your favorite linux projects for weekend
I got a minimal setup with pihole and nextcloud. I was wondering what else I could do. Share your ideas🙂
Friday Facts #393 - Putting things on top of other things | Factorio ( factorio.com )
[Question] Family oriented social network that is local only
Hey selfhosters,...
Best distro for data science? [request]
Ubuntu seems like it has the best compatibility, but any other suggestions for data wrangling, data analysis, data visualization, and machine learning in Julia, Python and R?
Software Technical Writing: A Guidebook [PDF] ( jamesg.blog )
radarr, docker & nvenc
Anyone done this? Got a set of repeatable instructions? My understanding is that the root docker image needs to switch from alpine to ubuntu and that hasn’t happened yet.
Apple wants AI to run directly on its hardware instead of in the cloud ( arstechnica.com )