1·
13 hours agoYes, there are broken uses of the HTTP protocol verbs where filtering to GET won’t work.
- 6 Posts
- 241 Comments
Joined 1 year ago
Cake day: June 17th, 2023
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
A simpler way to protect a private service with a reverse proxy is to only forward HTTP GET requests and only for specific paths.
It’s extremely difficult to attack a service with only GET requests.
The security of which URLS are accessible without authentication would be up to immich.
2·3 days agoI think you may be looking for a programmable keyboard.
With one, you can have arrow keys on the home row like vim, and make other universally recognized keys easy to reach including Home, End, PgUp, PgDn, App (right click), and all the modifiers. Some also build pointing devices into the keyboard as well.
I primarily use the Unicorne by Boardsource.
That’s something! But it doesn’t raise any money from people with other VPN providers or who don’t want to buy a VPN service.
Counterpoint: for those who prefer split ergo keyboards, the internal keyboard on laptops is rarely used.
A tablet where you can bring your own weird keyboard to pair with it is better.
Signal does a decent job of encouraging people to make one-time or ongoing donations to the service. I’ve supported them multiple times because they gave me a prompt to do so.
I don’t recall Firefox ever asking for a donation or subscription.
Mozilla could have allowed people the option to subscribe for a modest fee in addition to giving it away for free, to diversify their income and be less dependent on Google, but they have not been trying that hard to develop other revenue streams.
Although, If I have my own Amazon referral link in my blog post and they replace the referral code in their feed, I would not be happy about that.
They could be injecting their own ads or affiliate links into the content.
For example, if a post links to Amazon.
I have not looked at the source code.
Interesting research project but it’s not Linux and doesn’t natively run Linux apps.
https://www.theregister.com/2024/02/21/successor_to_unix_plan_9/
41·7 days agoThe story hypes this to be a bit more than this is.
Framework sent a laptop to the lead Mint dev. He’s going to try make sure it works well with Mint, but it already does.
The more low key framing straight on the Mint blog is here:
21·14 days agoWatching history repeat itself.
Date pickers that assume you have a 5 digit birth year.
There is a small LCD in the middle. This is a different brand, but the same idea.
I noticed they choose Fuzzel as the launcher / dmenu replacement. Me, too!
WhatsApp is a Meta business unit, yes.
And it has its own rules and policies for what is shared with other Meta business units.
Google has spell out the same. Just because you provide data like location to one Google service doesn’t automatically mean every other Google service can access it.
And they can’t just change their internal data policies however they like as some of this is governed by legal regulations.
Here’s a a story about how Google is not allowed to share data across business units without user consent, at least in the EU.
https://www.theverge.com/2024/1/12/24036312/google-digital-markets-act-services-user-data-opt-out
Here WhatsApp spells out what it shares with Meta:
I love that a Twitter founder founded Bluesky and the logo went from the outline of a white bird on a blue background to the outline of a white butterfly on a similar shade of blue background.
It’s reasonable not to trust them, but they could get in serious legal trouble if they are claiming the data is encrypted and they can’t access when in fact they can.
WhatsApp has a different business model. There are a lot of businesses on the platform and businesses are charged to do business messaging with users.
In some parts of the world WhatsApp has become a somewhat essential part of life so plenty of businesses what to participate and access the users there.
How Meta got into that position involved zero-rating— a practice where they work with ISPs to make sure there are no data fees to access WhatsApp.
While free seems good, the practice allowed WhatsApp to quickly dominate, crowd out competitors and make itself essential.
https://www.humanrightspulse.com/mastercontentblog/is-zero-rating-a-threat-to-human-rights
“What makes a zero-rating practice, like that of WhatsApp in Brazil, particularly threatening to human rights is when it is the only economically viable option for internet access in a society. In Brazil, as an internet connection can swallow up to 15% of the household income, users rely on these practises. As Professor Belli points out that economically, no other opportunity exists to assess the information being presented.”
Immich has a whole set of end-to-end automated tests to ensure they don’t accidentally make public any URLs they went to be private:
https://github.com/immich-app/immich/tree/main/e2e/src/api/specs
As a popular open source project, that would be e glaring security hole.
Using this proxy puts the trust in a far less popular project with fewer eyeballs on it, and introduces new risks that the author’s Github account is hacked or there’s vulnerability in he supply chain of this docker container.
It’s also not true that you “never need to touch it again” . It’s based on Node whose security update expire every two years. New image should be built at least every two years to keep to update with the latest Node security updates, which have often been in their HTTP/HTTPS protocol implementations, so they affect a range of Node apps directly exposed to the internet.