Just your normal everyday casual software dev. Nothing to see here.

People can share differing opinions without immediately being on the reverse side. Avoid looking at things as black and white. You can like both waffles and pancakes, just like you can hate both waffles and pancakes.

  • 0 Posts
  • 168 Comments
Joined 2 years ago
cake
Cake day: August 15th, 2023

help-circle

  • I would describe windows Office as a combination Spyware Malware. It actively collects data on you using obscure means, in an attempt to prevent you from knowing how it’s collecting it. It will also actively change your settings without your knowledge. With recent updates I would even classify it as potentially adware as well, since they mentioned adding advertisements to the start menu and explorer. since they hard push their office products.

    Honestly, with the fact that it also now force installs software against the users will on updates, the argument could be made that it’s slipping into trojan territory as well, it’s just lacking the backdoor access, but since they are hard pushing MS account authorization for login, I guess you don’t really need a backdoor when if you wanted to you could just force a password change and be able to login via the native login system.

    edit: I thought this post was based off MAS as in to activate windows, I just now realized it was MAS for office activation. I still think that the same applies, just not the trojan aspect. I have edited it to reflect it.


  • I’ve never rebuilt a container, but I also don’t have any containers that are deprecated status either. I swap off to alternatives when a project hits deprecation or abandonware status.

    My only deprecated container I currently have is filebrowser, I’m still seeking alternatives and have been for awhile now but strangely enough it doesn’t seem there are many web UI file management containers.

    As such though ever since I learned that the project was abandoned on life support(the maintainer has said they are doing security patches only, and that while they are doing more on the project currently, that could change), the container remains off, only activating it when i need to use it.






  • while docker does have a non-root installer, the default installer for docker is docker as root, containers as non-root, but since in order to manage docker as a whole it would need access to the socket, if docker has root the container by extension has root.

    Even so, if docker was installed in a root-less environment then a compromised manager container would still compromise everything on that docker system, as a core requirement for these types of containers are access to the docker socket which still isn’t great but is still better than full root access.

    To answer the question: No it doesn’t require it to function, but the default configuration is root, and even in rootless environment a compromise of the management container that is meant to control other containers will result in full compromise of the docker environment.


  • man, arcane looks amazing, I ended up deciding off it though as their pull requests look like they use copilot for a lot of code for new features. Not that I personally have an issue with this but, I’ve seen enough issues where copilot or various AI agents add security vulnerabilities by mistake and they aren’t caught, so I would rather stray away from those types of projects at least until that issue becomes less common/frequent.

    For something as detrimental as a management console to a program that runs as root on most systems, and would provide access to potentially high secure locations, I would not want such a program having security vulnerabilities.



  • For this one it really depends on the context. Many apps are super pushy and don’t give you notice they are even trying to do anything. If I was minding my own business and just happend to open amazon music on my phone to listen to music, I would get super confused about time my watch decided to try and pair itself to the account. Like first off, why are you messaging me, second why are you trying to do something i didn’t ask you to do.

    Granted I could tell right off what that message was likely indicating it wanted to do, but thats because I’ve used tech for years now and I understand how code based pairing works. I could defo see someone who wasn’t used to code based account pairing looking at that and saying “what does this mean, why do I need to go to a website and put a code in”








  • Pika@sh.itjust.workstoSelfhosted@lemmy.worldPSA syncthing-fork has changed owners
    link
    fedilink
    English
    arrow-up
    26
    arrow-down
    1
    ·
    edit-2
    2 months ago

    this entire thing has made me really rethink whether I want to swap to the new repo or not.

    Why was there no communication about it. The gplay repo maintainer wasn’t informed of anything, no public notice to anyone was given, just a transfer of the repo and a status issue here explaining it.

    Obviously the act is genuine as they were able to keep the original keys but like, this entire system seemed really sketchy.

    I’m also not happy with the fact that it seems the first thing they added was removing checksums, but that might be a temp thing.

    I also just noticed that it looks like they removed the entire public key for it, which if they had the original private keys using the existing public keys shouldn’t be an issue right?


  • One of my drives crippled itself a few days back, not sure what caused it. Wasn’t able to be resolved without a host restart which was unfortunate. SMART isn’t failing and has been working fine, so I’m chalking it down to a weird Proxmox bug or something.

    For sure expected I was going to need to do a rollback on an entire drive after that restart though. Still may have to if it reoccurs.