digiown

17 ms·

241.
by digiown 9mo ago
They cannot actually do this as long as they keep Claude code open source. It is always going to be trivial to replicate how it sends requests in a third party tool.
242.
by digiown 10mo ago
> one node needs a public IP/port A lot of people are behind CGNAT or behind a non-configurable router, which is an abomination. > Secure your router A typical router cannot be secured against physical access, unlike your servers
243.
by digiown 10mo ago
Look up mutual TLS / client authentication. Caddy and Immich supports it. Then you can expose it to the internet reasonably securely.
244.
by digiown 10mo ago
The VPS (using wg-easy or similar solutions) will be able to decrypt traffic as it has all the keys. I think most people self-hosting are not fine with big cloud eavesdropping on their data. Tailscale really is superior here if you use tail
245.
by digiown 10mo ago
Where will you host the wg endpoint to open up? - Each device? This means setting up many peers on each of your devices - Router/central server? That's a single point of failure, and often a performance bottleneck if you're o
246.
by digiown 10mo ago
A mesh-type wireguard network is rather annoying to set up if you have more than a few devices, and a hub-type network (on a low powered router) tends to be so slow that it necessitates falling back to alternate interfaces when you're
247.
by digiown 10mo ago
Tailscale has passkey-only account support but requires you to sign up in a roundabout way (first use an SSO, then invite another user, throw away the original). The tailnet lock feature also protects you to some extent, arguably more so th
248.
by digiown 10mo ago
I wouldn't disagree at all. But you often have to waste a lot of time to avoid them, if at all possible. It's a good thing that Android at least offers some protection against them exfiltrating your filesystem.
249.
by digiown 10mo ago
The situation is much better now. I've never had any issues with using the proprietary drivers on Arch on wayland in the past few years. If anything, AMD's drivers are noticeably more buggy.
250.
by digiown 10mo ago
Me too. But you have to be a lot more careful about not running proprietary crap on the desktop, which is easier to do than on phone. Ever been forced to install some crap for some event/business/etc?
251.
by digiown 10mo ago
If anything I see mainstream complaints about DRM in games, media, and lesser extent anti-cheat now more than ever, along with all the thrashing of Windows anti-user behavior. It is only natural that they go together. If there is a time to
252.
by digiown 10mo ago
I don't think there is a difference. They can need or want or demand and it doesn't matter. They don't have the right to weaponize my computer against me to fulfill their goals.
253.
by digiown 10mo ago
Android does have a meaningfully improved security over typical Linux desktop: the segmentation of data between apps. Imagine what would happen if people run all the proprietary crap they do on a typical Linux box. That's multiple spyw
254.
by digiown 10mo ago
> if you don't have full disk encryption someone could simply copy your disk. You can have full-disk encryption then. It can still possibly be compromised using more advanced methods like cold boot attacks but they are relatively in
255.
by digiown 10mo ago
Any data that leaves the machines you control, especially to a service like Notion, is already "exfiltrated" anyway. Never trust any consumer grade service without an explicit contract for any important data you don't want ex
256.
by digiown 10mo ago
This is such a comically uncharitable comment. > almost as if nobody switched to GTK4 even years after Debate all you want about libadwaita but that is gtk4 and people have written new apps with it
257.
by digiown 10mo ago
I think it's a mix of a few things: - The stuff being covered in high school is indeed pretty useless for most people. Not all, but most, and it is not that irrational for many to actually ignore it. - The reduction in social mobility
258.
by digiown 10mo ago
Good that at least you aren't forcing the student to sign up for these very exploitative services. I'm still somewhat concerned about exposing kids to this level of sycophancy, but I guess it will be done with or without using it
259.
by digiown 10mo ago
If you use the API directly via open webui, etc., it is not nearly as annoying. You can also system prompt it into sounding more reasonable.
260.
by digiown 10mo ago
> Intel or AMD They certainly aren't perfect, but they don't seem to be hell-bent on spying on or shoving crap into my face every waking hour for the time being. > insecure guests "Insecure" for the program against
261.
by digiown 10mo ago
> Using an EK to sign a boot state on hardware that doesn't match is a flag to an anti-cheat tool The idea is you implement a fake driver to sign whatever message you want and totally faking your hardware list too. As long as they a
262.
by digiown 10mo ago
Ah, I see, you're talking about Intel ME/AMD PSP? That's unfortunate and I'm obviously not happy with it, but so far there seems to be no evidence of it being abused against normal users. It's a little funny that th
263.
by digiown 10mo ago
It "protects" against this given the user already does not control the hypervisor, at which point all bets are off with regard to your rights anyway. It's actually worse than Windows in this regard. I would never use a comput
264.
by digiown 10mo ago
Ah, got it. With enough motivation this is still pretty easily defeated though. The key is in some kind of NVRAM, which can be read with specialized equipment, and once it's out, you can use it to spoof signatures on a different machin
265.
by digiown 10mo ago
Being able to snapshot and restore memory is a pretty common feature across all decent hypervisors. That in and of itself enables most client-side cheats. I doubt they'd bother to provide such a hypervisor for the vanishingly small int
266.
by digiown 10mo ago
How would that be implemented? I'd be curious to know. I'm not aware that a TPM is capable of hiding a key without the OS being able to access/unseal it at some point. It can display a signed boot chain but what would it be s
267.
by digiown 10mo ago
> getting more memory A bit hard to do now :(
268.
by digiown 10mo ago
What would that be useful for? A properly implemented software passkey like Keepassxc would be secure against anything short of a local root exploit. A TPM would not really help against that either.
269.
by digiown 10mo ago
Once a slave, always a slave. Running an explicitly anti-user proprietary kernel module that does god-knows-what is not something I'd ever be willing to do, games be damned. It might just inject exploits into all of your binaries and y
270.
by digiown 10mo ago
You can't implement remote attestation without a full chain of exploits (from the perspective of the user). Remote attestation works on Android because there is dedicated hardware to directly establish communication with Google's

More ›