• 0 Posts
  • 397 Comments
Joined 2 years ago
cake
Cake day: July 29th, 2023

help-circle


  • I really don’t want Apple to enter this market because then all the current OEMs will just be even more incentivized not to make generational advancements, and to just copy Apple’s Chinese grade quality to sell more slop because idiots will buy.

    Google already threw a grenade with their subpar pixel fold and then Samsung magically swapped off snapdragon for their zflip. If Apple joins, next they’ll start using plastic for the shell and still charge $999.

    People who think this won’t be a competitive product can just look to the past 20 years of Apple successfully selling stupid shit for exorbitant prices. I would even bet money it comes with an even deeper crease than current gen foldables against the “new hinge tech” hype this guy is claiming.


  • Okay so step one is to take GNOME and throw it into the trash where it belongs, and replace it with KDE which is a complete DE and not a bunch of plugins disguised in a trench coat of bash scripts.

    Step two is to recommend a distro that targets both user quality and latest stable kernel releases for the most updated modules (Like Fedora or OpenSUSE)

    Linux needs to adopt executable installers for software packages that can be downloaded on the web

    Is the wrong problem because that’s what Flatpak accomplishes without creating distro dependency hell. Regressing to .run and .appimage files for everything is why windows updates suck total ass, and it would nuke one of Linux’s most killer features.

    Users are already used to an appstore on mobile, I can personally guarantee you that they have no trouble getting accustomed to a desktop app installer, especially since they find it so much easier to search and click install without opening a bunch of websites. Since it shows both package manager and flatpak apps, they don’t even have to be aware of the backend system.

    The only thing holding back linux at this current point in time is honestly just vendors using it standard in consumer hardware. The dependency hell issue was resolved years ago by both huge improvements in package repos and the widespread support of Flatpak. The leftover baggage from X11 has been replaced by Wayland, which finally became viable around end of 2023. Even stuff like pulseaudio has been replaced by pipewire to handle every edge cases scenario.

    I would not have said the same thing 2 years ago. The evidence is that the linux desktop user base is growing at an increasing rate. All they need is to hit a critical share (6-7%) for bigger vendors and OEMs to follow.

    The good news is, as mentioned, there are a lot of vendors that are starting to do this. Valve’s steam machine by itself could be enough to add another 10 million users if they play their cards right.

    My other anecdotal evidence is that I successfully changed several of my friends and family members over to Fedora just last year because I finally found it viable to throw at any former Windows user.

    The only dissatisfaction I caused was one “dependent” person who couldn’t play Fortnite (the only game in their library that didn’t work), which I audaciously told it would be possible in 2026 via waydroid/lepton (valve plz dont fail me lol).







  • AFAIK this has already been a problem, you can find Samsung M.2 SSDs for cheaper than Samsung SATA SSDs at the same capacity, because their cloud customers have all flown past classic SATA/SAS for NVME U.2 and U.3, which is much more similar to M.2 due to NVME.

    I was planning on adding a big SSD array to my server which has a bunch of external 2.5 SAS slots, but it ended up being cheaper and faster to buy a 4 slot M.2 PCIe card and buy 4 M.2 drives instead.

    Putting it on a x16 PCIe slot gives me 4 lanes per drive with bifurication, which gets me the advertised maximum possible speed on PCIe 4.

    Whether or not the RAM surge will affect chip production capacity is the real issue. It seems all 3 OEMs could effectively reduce capacity for all other components after slugging billions of dollars into HBM RAM. It wouldn’t just be SSDs, anything that relies on the same supply chain could be heavily affected.


  • mlg@lemmy.worldtoSelfhosted@lemmy.worldDocker security
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    1
    ·
    1 month ago

    How I sleep knowing Fedora + podman actually uses safe firewalld zones out of box instead of expecting the user to hack around with the clown show that is ufw.

    I could be wrong here but I feel like the answer is in the docs itself:

    If you are running Docker with the iptables or ip6tables options set to true, and firewalld is enabled on your system, in addition to its usual iptables or nftables rules, Docker creates a firewalld zone called docker, with target ACCEPT.

    All bridge network interfaces created by Docker (for example, docker0) are inserted into the docker zone.

    Docker also creates a forwarding policy called docker-forwarding that allows forwarding from ANY zone to the docker zone.

    Modify the zone to your security needs? Or does Docker reset the zone rules ever startup? If this is the same as podman, the docker zone should actually accept traffic from your public zone which has your physical NIC, which would mean you don’t have to do anything since public default is to DROP.



  • Do these updates not go through any rigorous testing at all

    Lol no, MSFT infamously dropped their entire Hardware QA team after WIndows 7 and instead relied on the also infamous insider hub to get QA “feedback” from home users instead, leading to the also infamous Windows 8 disaster and slightly less infamous critical CVEs that went unaddressed because MSFT ddidn’t even bother to read the insider hub posts.

    Oh and they didn’t learn anything and kept running with the insider hub well into Windows 10 & 11.





  • Really?

    This is literally where LLMs have probably the most advantageous use with practically no downsides. Their devs aren’t idiots that are suddenly vibe coding. Using an LLM can be an invaluable tool.

    Linux already has merged code that had some form of LLM input years ago.

    It’s not about whether or not you’re using an LLM as part of your work process, its more about whether or not you’re submitting shitty code.

    Even if you want an alternative for this reason, I can probably bet you that several PRs in Vaultwarden were probably looked over by someone’s Claude chat while they were writing and testing it, or straight up took generated code and edited to their needs.

    Hell I’d even bet Lemmy has PRs that have been touched by LLMs.




  • This one is funny because it 100% still exists somewhere, but I haven’t had the chance to verify it again.

    Okay so basically its a data recorder box (ex: brainbox) that connects to a bunch of industrial sensors and sends the data over the network with your preferred method.

    Builtin firmware gives you an HTTP webui to login and configure the device, with a user # and password.

    I think the user itself had a builtin default admin which was #0, which everyone uses since there wasn’t really much use for other users.

    Anyway, I was looking at the small JS code for the webui and noticed it had an MD5 hashing code that was very detailed with comments. It carefully laid out each operation, and explained each step to generate a hash, and then even why hashes should be used for passwords.

    Here’s the kicker: It was all client side JS, so the login page would take your password, hash it, and then send the hash over plaintext HTTP POST to the server, where it would be authenticated.

    Meaning you could just mitm the connection to grab the hash, and then login with the hash.

    I sat there for like 10 minutes looking at the request over and over again. Like someone was smart enough to think “hey let’s use password hashing to keep this secure” and then proceeded to use it in the compleltly wrong way. And not even part of like a challenge/handshake where the server gives you a token to hash with. Just straight up MD5(password).

    It was so funny because there were like a hundred of these on a network, so getting a valid hash was laughably easy.

    I never got to check if this was fixed in a newer firmware version.