NaibofTabr

Trained on a corpus of messages written primarily by the people who spend the most time using the Internet to talk to their friends… teenagers.

Imagine dumping the entire content of Snap, Instagram, Kik, Facebook messenger, etc, into a blender and attempting to derive a style of speech from it. The most impressive thing about these LLMs is that they’re (marginally) coherent.

I have experience managing multiple network systems with user-facing endpoints. That’s irrelevant.

Nothing critical on a passenger-carrying vehicle should be remotely managed and it definitely should be frozen while the bus is in active service. The last thing a crowded bus in motion needs is the lights randomly going out because someone decided it was time for a patch install.

The right choice from a security and safety perspective is for any wireless interfaces on the vehicle to be read-only - they can send data out (like current location). Pushing software changes should require direct physical access, and should only work if the vehicle is parked. Anything else is a stupid unnecessary risk.

The simplest solution is to just restrict software updates to direct physical access, and put the USB port or whatever behind a locked service panel.

If the software can’t be infiltrated remotely, then there won’t be any security issues that are so urgent they need to be patched in the middle of a shift, they can wait for a maintenance stop.

Location tracking, diagnostics, statistics, security. Etc. it’s not a bad idea… for a bus.

There’s no good reason for any of that to be updated while the bus is on the road. It should be done at a service location.

The post is not a description of large-scale infrastructure takeover. That was literally the point of this comment thread.

You’re right, the person I responded to did make a lot of assumptions.

but that was a government takeover.

How else do you imagine a large-scale infrastructure would happen? an angry mob?

This reminds me of that old psychology experiment with children and marshmallows.

Yes, just grab what you want right now, surely that is the best way to do things. Good job demonstrating moral superiority over those selfish bourgeoisie.

How do you know that the “supermarkets” referenced in OP were not locally owned? This is 1973 in Italy, we’re not talking about Wal-Mart.

What exactly would prevent these nutjobs from doing the same thing to locally owned stores? Do you think they were being particularly selective in their grandstanding tactics?

Oh yeah, they tried this in China in the 50s. It went great.

Perfect explanation.

Thank you, I try. It’s always tricky to keep network infrastructure explanations concise and readable - the Internet is such a complicated mess.

People like paying for convenience.

Well, I would simplify that to people like convenience. Infrastructure of any type is basically someone else solving convenience problems for you. People don’t really like paying, but they will if it’s the most convenient option.

Syncthing is doing this for you for free, I assume mostly because the developers wanted the infrastructure to work that way and didn’t want it to be dependent on DNS, and decided to make it available to users at large. It’s very convenient, but it also obscures a lot of the technical side of network services which can make learning harder.

This kind of thing shows why tech giants are giants and why selfhosted is a niche.

There’s also always the “why reinvent the wheel?” question, and consider that the guy who is selling wheels works on making wheels as a full-time occupation and has been doing so long enough to build a business on it, whereas you are a hobbyist. There are things that guy knows about wheelmaking that would take you ten years to learn, and he also has a properly equipped workshop for it - you have some YouTube videos, your garage and a handful of tools from Harbor Freight.

Sometimes there is good reason to do so (e.g. privacy from cloud service data gathering) but this is a real balancing act between cost (time and money, both up-front and long-term), risk (privacy exposure, data loss, failure tolerance), and convenience. If you’re going to do something yourself, you should have a specific answer to the question, and probably do a little cost-benefit checking.

Right, OK, but Signal sustains itself on charity.

But if I’m reading the materials correctly, I’ll need to set up a domain and pay some upfront costs to make my library accessible outside my home.

Why is that?

So when your mobile device is on the public internet it can’t reach directly into your private home network. The IP addresses of the servers on your private network are not routable outside of it, so your mobile device can’t talk to them directly. From the perspective of the public internet, the only piece of your private network that is visible is your ISP gateway device.

When you try to reach your Syncthing service from the public internet, none of the routers know where your private Syncthing instance is or how to reach it. To solve this, the Syncthing developers provide discovery servers on the public internet which contain the directions for the Syncthing app on your device to find your Syncthing service on your private network (assuming you have registered your Syncthing server with the discovery service).

This is a whole level of network infrastructure that is just being done for you to make using Syncthing more convenient. It saves you from having to deal with the details of network routing across network boundaries.

Funkwhale does not provide an equivalent service. To reach your Funkwhale service on your private network from the public internet you have to solve the cross-boundary routing problem for yourself. The most reliable way to do this is to use the DNS infrastructure that already exists on the public internet, which means getting a domain name and linking it to your ISP gateway address.

If your ISP gateway had a static address you could skip this and configure whatever app accesses your Funkwhale service to always point to your ISP gateway address, but residential IP addresses are typically dynamic, so you can’t rely on it being the same long-term. Setting up DynamicDNS solves this problem by updating a DNS record any time your ISP gateway address changes.

There are several DynDNS providers listed at the bottom of that last article, some of which provide domain names. Some of them are free services (like afraid.org) but those typically have some strings attached (afraid.org requires you to log in regularly to confirm that your address is still active, otherwise it will be disabled).

Right, that would be the kind of “collective action” that I mentioned… it doesn’t have anything to do with preventing nations from going to war with each other… the UN doesn’t have that kind of authority and never did.

This might seem callous, but… the purpose of the UN was never to prevent wars from happening. The UN is an international forum, it is not a world government. The purpose is to create a space for nations to talk to each other, and to organize collective action on issues that the majority of members agree on. The UN was not intended to override the sovereignty of member nations - if it was, nations wouldn’t join in the first place.

Assuming this is a desktop PC, prevention is much better. Get a case with dust filters (preferably removable) on the intake fans or just add some to your existing case. I would call this essential if you have pets.

UBIOS’s unique features over UEFI include increased support for chiplets and other heterogeneous computing use-cases, such as multi-CPU motherboards with mismatching CPUs, something UEFI struggles with or does not support. It will also better support non-x86 CPU architectures such as ARM, RISC-V, and LoongArch, the first major Chinese operating system.

Hmm, I haven’t read the full spec, but typically when you’re making mismatched components work together like this it means you can only support security features that are common for all of them - that is, any security can only be the lowest common standard. Does anybody know where to find more specific information on security features in UBIOS? Wider compatibility generally means more vulnerability.

One of the major design goals of UEFI was to add security to BIOS, which never had any real security in its design. If UBIOS is less secure than UEFI then it’s really not a good idea to use it for anything beyond personal devices.

Does UBIOS have feature parity with UEFI or is it just targeting a different use case altogether? UEFI’s security features are still not complete protection, but it would be a terrible idea to run a network server without them in the present cybersecurity environment.

AWS is a huge suite of products and services, and there’s a lot of old legacy shit running on it.

Yup, AWS is legacy cloud. It was only recently that they set encryption by default on S3 buckets, before that they were just in the clear by default.

Cybersecurity and disaster recovery are not directly profitable, so they are almost always neglected in your average shop.

It’s never important until suddenly it’s the most important thing in the world.

Yeah, but proper failover and recovery requires additional infrastructure, and that costs money.

Hopefully a bunch of risk management people are writing I-told-you-so emails to C-suites right now.

Damn man, you are really bending over backward to defend this guy… do you owe him money or something?