• 0 Posts
  • 320 Comments
Joined 2 years ago
cake
Cake day: July 29th, 2023

help-circle








  • I don’t know why people are freaking out over this article. It’s pretty well known that lots of animals (especially within their own class) have eggs that can be fertilized by different species. It doesn’t matter like 99.99% of the time because the resulting cell is unviable and will not develop into anything because the merged DNA is incompatible and will fail to generate into a developed organism.

    The exception to this are hybrids (like a mule), rare cases where similar enough species can actually create a viable fetus, but the resultant hybrid is usually sterile and unable to reproduce its own offspring: https://en.wikipedia.org/wiki/Hybrid_(biology)


  • mlg@lemmy.worldtoSelfhosted@lemmy.worldDocker security
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    1
    ·
    edit-2
    19 days ago

    How I sleep knowing Fedora + podman actually uses safe firewalld zones out of box instead of expecting the user to hack around with the clown show that is ufw.

    I could be wrong here but I feel like the answer is in the docs itself:

    If you are running Docker with the iptables or ip6tables options set to true, and firewalld is enabled on your system, in addition to its usual iptables or nftables rules, Docker creates a firewalld zone called docker, with target ACCEPT.

    All bridge network interfaces created by Docker (for example, docker0) are inserted into the docker zone.

    Docker also creates a forwarding policy called docker-forwarding that allows forwarding from ANY zone to the docker zone.

    Modify the zone to your security needs? Or does Docker reset the zone rules ever startup? If this is the same as podman, the docker zone should actually accept traffic from your public zone which has your physical NIC, which would mean you don’t have to do anything since public default is to DROP.






  • mlg@lemmy.worldtoLemmy Shitpost@lemmy.worldLibraries are cool
    link
    fedilink
    English
    arrow-up
    27
    arrow-down
    2
    ·
    1 month ago

    Unless the library is tracking book reader stats or you actually check out the book, maybe remember how the classification system works like they were supposed to teach you in school?

    Half the time I’m literally standing in front of the shelf perusing the book, it would be dumb to throw it in the book return unless I don’t know or can’t find the exact position where it came from.



  • This one is funny because it 100% still exists somewhere, but I haven’t had the chance to verify it again.

    Okay so basically its a data recorder box (ex: brainbox) that connects to a bunch of industrial sensors and sends the data over the network with your preferred method.

    Builtin firmware gives you an HTTP webui to login and configure the device, with a user # and password.

    I think the user itself had a builtin default admin which was #0, which everyone uses since there wasn’t really much use for other users.

    Anyway, I was looking at the small JS code for the webui and noticed it had an MD5 hashing code that was very detailed with comments. It carefully laid out each operation, and explained each step to generate a hash, and then even why hashes should be used for passwords.

    Here’s the kicker: It was all client side JS, so the login page would take your password, hash it, and then send the hash over plaintext HTTP POST to the server, where it would be authenticated.

    Meaning you could just mitm the connection to grab the hash, and then login with the hash.

    I sat there for like 10 minutes looking at the request over and over again. Like someone was smart enough to think “hey let’s use password hashing to keep this secure” and then proceeded to use it in the compleltly wrong way. And not even part of like a challenge/handshake where the server gives you a token to hash with. Just straight up MD5(password).

    It was so funny because there were like a hundred of these on a network, so getting a valid hash was laughably easy.

    I never got to check if this was fixed in a newer firmware version.


  • Lots of games that ship with kernel level anticheat have an android port that doesn’t have that feature because android (also linux) similarly doesn’t hand out root access, let alone kernel access to anything in userland.

    Huge example being Fortnite.

    Already ignoring the fact that kernel level anticheats have well known bypasses, cheaters can also just use the Android version to make cheating easier if that was really an obstacle.

    Anyone peddling kernel anticheat as a requirement is just using it to cut costs in running moderation staff. Epic Games specifically is just being a dick to linux because they know they have zero leverage in that market, and don’t want to give Steam more traffic.

    All Valve really has to do is sell enough units to tip the percent of linux users that these publishers would not want to miss out on. That’s how so many updated and expanded with the steam deck. Currently the estimate is about 4 million monthly active users on a linux platform. I think if they can reach 10 million (I think 6-7%), it would be enough to incentivize the change.

    I never would have thought Microsoft would allow Halo Infinite or MCC on linux 5 years ago, but they actually changed their minds because they knew people wanted to play on the steam deck. I would even take a guess that the new CoD stuff will shortly follow since MSFT is taking a more open platform approach anyway.

    EDIT:



  • Even though LTT said valve gave a cold stare at a $500 price tag, the BOM estimate is sitting around $420 (compared to $300 for the deck).

    If they follow the same path as the steam deck, they could still comfortably sell the base model at $600 or $550 if they want to get aggressive with consoles.

    Valve basically broke even with the base model steam deck, so I’m assuming the remaining $100 per unit cost is all the external stuff like production shipping etc. They make profit on the higher level models by charging more for storage and OLED.

    Valve’s plan was never to compete with consoles, but they’re sitting on a golden opportunity here with Xbox flailing in the water and being able to price match without loss. Their major blocker is the anti cheat holdouts though, and I don’t think they’ll be willing to change unless steam machine itself becomes very popular, which forms an annoying loop.

    I think they’re probably having some great arguments behind the scenes on what point exactly they should settle on based off of the public response everyone is giving from this statement lol.