• 4 Posts
  • 220 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle
  • Dropping instead of blocking might technically be better because it wastes a bit more bot time and they see it as “it doesn’t exist” rather than an obsticle to try exploits on. Not sure if that is true though.

    For me:

    • ssh server only with keys

    • absolutely no ssh forwarding, only available to local network via firewall rules

    • docker socket proxy for everything that needs socket access

    • drop non-used ports, limit IPs for local-only services (e.g. paperless)

    • crowdsec on traefik for the rest (sadly it blocks my VPN IPs also)

    • Authelia over everything that doesn’t break the native apps (jellyfin and home assistant are the two that it breaks so far, and HA was very intermittent so I made a separate authelia rule and mobile DNS entry for slightly reduced rules)

    • proper umask rules on all docker directories (or as much as possible)

    • main drive FDE with a separate boot drive with FDE keyfile on a dongle that is removed except for updates and booting to make snatch-and-grabs useless and compromising bootloader impractical

    • full disk encryption with passworded data drives, so even if a smash and grab happens when I leave the dongle in, the sensitive data is still encrypted and the keys aren’t in memory (makes a startup script with a password needed, so no automated startups for me)

    For more info, I followed a lot of stuff on: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server


  • They are a massive megacorp though. It always leaves me to wonder “how much”.

    Tons of capitalist companies do stock options where “technically” the employees own a share of the company, though that percentage is usually extremely small, even collectively such that they have no decision power. I can’t help but think that it is similar with huawei, but with better marketing.














  • The only thing about jellyfin is the damn subtitles. Subtitle sync is horrible. They added a subtitle offset feature last year which was a good workaround and then removed it a few months ago on androidtv and android. Now the subtitle offset on the web player doesn’t do anything anymore either

    Even Subgen generated subtitles, which are pretty perfectly in sync in reality, are sometimes played back at an incorrect speed so it will progressively get more and more out of sync, but there is no way to tell what speed the subtitles are being played at.

    Also it just ignores themes a lot of times or only displays themes on the admin console and nowhere else.

    That said, jellyfin is still amazing!