• 1 Post
  • 771 Comments
Joined 2 years ago
cake
Cake day: July 29th, 2023

help-circle
  • mlg@lemmy.worldtoSelfhosted@lemmy.worldDocker security
    link
    fedilink
    English
    arrow-up
    15
    arrow-down
    1
    ·
    23 hours ago

    How I sleep knowing Fedora + podman actually uses safe firewalld zones out of box instead of expecting the user to hack around with the clown show that is ufw.

    I could be wrong here but I feel like the answer is in the docs itself:

    If you are running Docker with the iptables or ip6tables options set to true, and firewalld is enabled on your system, in addition to its usual iptables or nftables rules, Docker creates a firewalld zone called docker, with target ACCEPT.

    All bridge network interfaces created by Docker (for example, docker0) are inserted into the docker zone.

    Docker also creates a forwarding policy called docker-forwarding that allows forwarding from ANY zone to the docker zone.

    Modify the zone to your security needs? Or does Docker reset the zone rules ever startup? If this is the same as podman, the docker zone should actually accept traffic from your public zone which has your physical NIC, which would mean you don’t have to do anything since public default is to DROP.


  • It fits the bill of cheap and reliable, but not “modern”*. The heat retention is very useful, and handling the surface of the pan itself is easy when you’re using it to cook constantly.

    Non-stick more often than not is going to be cheap and modern, but not reliable because high quality non stick pans are expensive (or people opt for enamel instead because of low quality PTFE/PFAS that both scrapes off easily and can’t handle high heat which is dangerous, https://www.youtube.com/watch?v=N-eBmPSqd4g)

    I would argue the “upgrade” to cast iron is carbon steel, which is much more common as a wok material. You get a nice balance between affordable, reliable, and modern.

    • *By modern, I just mean the underlying technology. Cast iron is pretty old and has its own flaws you have to deal with, and it lacks some of the nice features of newer materials.

    gas vs. electric vs. induction vs infrared…

    The tier list is:

    • Induction (most responsive heat control)
    • Gas (Slightly less responsive heat control
    • Infrared (Electric, much slower)
    • Electric (direct heating element, as slow as infrared but lacks the heat retention, have not seen these outside bargain basement cheapo units landlords like to put in apartments solely to screw with your ability to cook food normally)

    Gas and Induction is always preferable because infrared is slow enough to be at the best annoying and at the worst less forgiving if you mess up the temperature. Induction comes with the great advantage that it doesn’t require a special gas line, and you can actually buy single unit cooktops for pretty cheap, but do keep in mind that induction only works on magnetic metals (won’t work with pure copper or aluminum).



  • Do these updates not go through any rigorous testing at all

    Lol no, MSFT infamously dropped their entire Hardware QA team after WIndows 7 and instead relied on the also infamous insider hub to get QA “feedback” from home users instead, leading to the also infamous Windows 8 disaster and slightly less infamous critical CVEs that went unaddressed because MSFT ddidn’t even bother to read the insider hub posts.

    Oh and they didn’t learn anything and kept running with the insider hub well into Windows 10 & 11.







  • Same, I enjoy the classic shared library and package system which I still feel is superior to flatpak versions in most cases, even ignoring the technical aspects of each.

    Tried silverblue once and it just felt more like android to me, and I even found myself using RPM layers almost immediately for core things that dont ship as Flatpak because its infeasible.

    Plus Bazzite has its own release schedule which I feel like slightly removes the benefit of Fedora kernels being cutting edge, with critical packages updated almost as fast as Arch.

    The good thing though is that it’s much more dummy proof, so I would feel comfortable letting anyone use it with zero experience, whereas I only recommend Fedora to those who have an inherent interest in Linux.







  • This one is funny because it 100% still exists somewhere, but I haven’t had the chance to verify it again.

    Okay so basically its a data recorder box (ex: brainbox) that connects to a bunch of industrial sensors and sends the data over the network with your preferred method.

    Builtin firmware gives you an HTTP webui to login and configure the device, with a user # and password.

    I think the user itself had a builtin default admin which was #0, which everyone uses since there wasn’t really much use for other users.

    Anyway, I was looking at the small JS code for the webui and noticed it had an MD5 hashing code that was very detailed with comments. It carefully laid out each operation, and explained each step to generate a hash, and then even why hashes should be used for passwords.

    Here’s the kicker: It was all client side JS, so the login page would take your password, hash it, and then send the hash over plaintext HTTP POST to the server, where it would be authenticated.

    Meaning you could just mitm the connection to grab the hash, and then login with the hash.

    I sat there for like 10 minutes looking at the request over and over again. Like someone was smart enough to think “hey let’s use password hashing to keep this secure” and then proceeded to use it in the compleltly wrong way. And not even part of like a challenge/handshake where the server gives you a token to hash with. Just straight up MD5(password).

    It was so funny because there were like a hundred of these on a network, so getting a valid hash was laughably easy.

    I never got to check if this was fixed in a newer firmware version.