lucideer

12 ms·

181.
by lucideer 1y ago
> the intended experience is that you get apps from the play/app store Once again, this is the point. > it doesn't imply you oppose the freedom to run whatever code you want But it does. Let's first look at what&#x2
182.
by lucideer 1y ago
> Can you corroborate this? I don't think this is so much a question of sources & corroboration as it is of language. Regardless of the origins of the term "sideload", the language implies a non-standard practice. Th
183.
by lucideer 1y ago
Nice! First feature request: allow disabling all the `tput setab 0` calls throughout the codebase. This may make screensavers look weird on white terminals but should improve them for anyone using non-black-but-dark terminal themes.
184.
by lucideer 1y ago
This is great to avoid ai but doesn't solve the index quality decline. (though it might be a case of there simply being no good search anymore)
185.
by lucideer 1y ago
> I'm solely relying on DuckDuckGo I've been fully on DDG for years but becoming slowly skeptical & looking for alternatives. 1. They're leaning heavily into "responsible AI", much like Mozilla 2. Might be
186.
by lucideer 1y ago
Acknowledging that a huge number of people (the vast majority) are going to use the only option they know rather than the best of a set of options they know, I still think that for a person who's fully versed in all available options,
187.
by lucideer 1y ago
I'm absolutely not an expert of any kind on protocol details, so pardon my ignorance here but this surprises me: is this true? High-level spec changes have been infrequent, with long dual support periods, & generally seen pretty sl
188.
by lucideer 1y ago
> overhead of the http layer Detail of this well-covered in sibling comments, but at a higher-level, two thoughts on this: 1. I see a lot of backlash lately against everything being HTTP-ified, with little justification other than a pr
189.
by lucideer 1y ago
It's builds from PRs that can be submitted by anyone with a GitHub account
190.
by lucideer 1y ago
Which subdomain?
191.
by lucideer 1y ago
The legitimate reason is that the domain is correctly classified as having user generated active content, because the Immich GitHub repo allows anyone to submit arbitrary code via PR, and PRs can be autodeployed to this domain without passi
192.
by lucideer 1y ago
Anyone can open a PR. Deploys are triggered by an Immich collaborator labelling the PR, but it doesn't require them to review or approve the code being deployed.
193.
by lucideer 1y ago
> its target variable is not present, that is the very definition of a false positive The target variable is user hosted content on subdomains of a domain not listed in Mozilla's public suffix list. Firefox & Chrome apply a mu
194.
by lucideer 1y ago
I guess you're right - I find the tone off but it's not egregious & it is mostly a very useful list.
195.
by lucideer 1y ago
Which subdomains? To be clear, the issue here is that some subdomains pose a risk to the overall domain - visiting any increases your risk from others. It's also related to a GitHub workflow that auto-generates new subdomains on demand
196.
by lucideer 1y ago
> mitigating false positives First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. I think there's likely a co
197.
by lucideer 1y ago
*botnet
198.
by lucideer 1y ago
This is imo ultimately a problem with git. If git didn't have this setting, then after checking out a bash file with LFs in it, there are many Windows editors that would not be able to edit that file properly. That's a limitation
199.
by lucideer 1y ago
A safe browsing service is not a terrible idea (which is why both Safari & Firefox use Google for this) & while I hate that Google has a monopoly here, I do think a safe browsing service should absolutely block your preview environm
200.
by lucideer 1y ago
.cloud is used to host the map embedded in their webapp. In fairness, in my local testing sofar, it appears to be an entirely unauthenticated/credential-less service so there's no risk to sessions right now for this particular use
201.
by lucideer 1y ago
> This part is not correct: the "preview" label can be set only by collaborators. That's good & is a decent starting point. A decent second step might be to have the Github Actions workflow also check the approval st
202.
by lucideer 1y ago
Allowing user publishing is an inherent risk - these are good mitigations but nothing will ever be bulletproof. The main issue is protecting innocent users from themselves - that's a hard one to generalise solutions to & really dep
203.
by lucideer 1y ago
I love Immich & greatly appreciate the amazing work the team put into maintaining it, but between the OP & this "Cursed Knowledge" page, the apparent team culture of shouting from the rooftops complaints that expose their
204.
by lucideer 1y ago
> how do I protect my site or sites of clients from being subjected to this. Is there anything proactive that can be done? Some steps to prevent this happening to you: 1. Host only code you own & control on your own domain. Unless.
205.
by lucideer 1y ago
I think my comment came across a bit harsh - the Immich team are brilliant. I've hosted it for a long time & couldn't be happier & I think my criticisms of the tone of the article are likely a case of ignorance rather than
206.
by lucideer 1y ago
It is but this established pattern is well standardised & documented by the public suffix list project. There's generally two conventions followed for this pattern: 1. Use a separate dedicated domain (Immich didn't do this - t
207.
by lucideer 1y ago
Unless I missed something in the article this seems like a different issue. The article is specifically about the domain "immich.cloud". If you're using your own domain, I'd check to ensure it hasn't been actually c
208.
by lucideer 1y ago
This. I cannot believe the rest of the comments on this are seemingly completely missing the problem here & kneejerk-blaming Google for being an evil corp. This is a real issue & I don't feel like the article from the Immich te
209.
by lucideer 1y ago
They're auto-deploying PRs to a subdomain of a domain that they also use for production traffic. This allows any member of the public with a GitHub account to deploy any arbitrary code to that subdomain without any review or approval f
210.
by lucideer 1y ago
I've rarely seen a HN comment section this overwhelmingly wrong on a technical topic. This community is usually better than this. Google is an evil company I want the web to be free of, I resent that even Firefox & Safari use this

More ›