A person with way too many hobbies, but I still continue to learn new things.

  • 1 Post
  • 105 Comments
Joined 1 year ago
cake
Cake day: June 7th, 2023

help-circle


  • The terms of linux don’t come into play unless I try to re-use some other licensed code to make a profit, and that would still fall under copyright law rather than any kind of terms&services clause. Installing a piece of software doesn’t constitute an agreement unless there are clear terms given at the beginning of the installation (and even then it has been pretty questionable in court cases). There was nothing presented to me to agree to during the installation and I’ve never once been asked to agree to anything during the installation of any software on my computer. There’s no need for something like this in most linux software other than the standard disclaimer that it comes with no warranty. Still not anything I had to click to agree to, it just happens to be on the websites for the distributions.

    Even if you want to try and pretend that I somehow agreed so some nonsense conditions by installing linux, it still doesn’t meet your conditions of putting myself at a disadvantage to the manufacturer. Surely you’re not trying to suggest that my “disadvantage” is that I can’t take a group to court for my own failure to use software which was freely given and distributed, and of which very little was even written by the distribution maintainers? That would be as absurd as claiming that I had to agree to an EULA before installing my operating system. Hell I don’t even agree to collecting data about package management on my system.





  • There was no such thing as a default firewall, but even now when I set up a new Debian machine there are no firewall rules, just the base iptables installed so you CAN add rules. Back then we also had insecure things like telnet installed by default and exposed to the world, so there’s really no telling exactly how they managed to get into my machine. It’s still good to learn about network security up front rather than relying on any default settings if someone is planning on self-hosting.


  • This was back in '99 and I didn’t know much about linux (or servers) at the time, so I’m not exactly sure what they did… but one morning I woke up and noticed my web service wasn’t working. I had an active login on the terminal but was just getting garbage from it, and I couldn’t log in remotely at all. My guess was that someone hacked in, but hacked the system so badly that they basically trashed it. I was able to recover a little data straight from the drive but I didn’t know anything about analyzing the damage to figure out what happened. so I finally ended up wiping the drive and starting over.

    At that point I did a sped-run of learning how to set up a firewall, and noticed right away all kinds of attempts to hit my IP. It took time to learn more about IDS and trying not to be too wreckless in setting up my web pages, but apparently it was enough to thwart however that first attacker got in. Eventually I moved to a dedicated firewall in front of multiple servers.

    Since then I’ve had a couple instances where someone cracked a user password and started sending spam through, but fail2ban stopped that. And boy are there a LOT of attempts at trying to get into the servers. I should probably bump up fail2ban to block IPs faster and over a longer period when they use invalid user names since attacks these days happen from such a wider range of IPs.


  • I have 56k of comment karma and only 792 post karma (no K there,only 792) but I got an email as well. Technically I guess I’m a mod because I started a sub with another guy but it never saw anything beyond the greetings post. However my account is over 13 years old so maybe that counts for something?

    And yeah, I have no intention of wasting my money. They might see a slight profit initially as some might view this as the “new shiny”, but then I fully expect it to tank the moment the investors get a look at their records and start jumping ship.




  • I see a number of comments to use a virtual server host, but I have not seen any mention of the main reason WHY this is advisable… If you want to host something from your home, people need a way to reach you. There are two options for this – use a DDNS service (generally frowned upon for permanent installations), or get a static IP address from your provider.

    DDNS means you have to monitor whenever your local IP address changes, send out updated records, and wait for those changes to propagate across the internet. This generally will mean several minutes or more of down time where nobody can reach your server, and can happen at completely random times.

    A static IP is reliable, but they cost money, and some providers won’t even give you the option unless you get a business-class connection, which costs even more money. However this cost is usually already rolled into the price of a virtual machine.

    Keep in mind also that when hosting at home, simply using a laptop to stay online 24/7 is not enough, you also need a battery backup for your network equipment. You will want to learn about setting up a firewall and some kind of IDS to protect the front end of your services, but for starting out you can host this on the same machine as your other services. And if you really want to be safe, set up a second internal machine that you can perform regular backups to, so when your machine gets hacked you have a way to restore the information.

    My first server was online for two whole weeks before someone blew it up. Learn security first, everything after that will be easy.




  • At the very least, manufacturers should be required to make their android build files available, even if they are kept in an escrow until the manufacturer stops selling that model (or they go out of business). Most of the phones going to the dump are because no updates are available, even though the hardware is still fine and any individual person (with a little patience) could build the latest release if they had the hardware bin files available.





  • Seems like it would never stand up in court. Prove that -I- agreed to anything. To do that, you first have to prove that nobody has ever created an account under my name, and more importantly, prove that Reddit accounts have never been hacked and that the person who clicked the button was even in my household. And if they keep that extensive of records to where they can follow every action taken by every user on the platform, it also implies that they are tracking my personal actions even before I agreed to anything.

    On the other hand, do they actually have a EULA? It’s been almost 14 years since I created my account, and there certainly wasn’t anything about selling my data for AI training when I signed up. If they change the terms of service, they are responsible for notifying everyone, otherwise they can’t claim that anyone agreed to these changes.

    I’m sure their lawyers could weasel their way through it some how, but it still seems to come down to them claiming they changed the agreement without notification but the users should still be legally bound by the new terms?