Mama told me not to come.

She said, that ain’t the way to have fun.

  • 2 Posts
  • 1.83K Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle



  • Yeah, I completely agree.

    I drive old cars because they don’t spy on me and they’re inexpensive to own. I have an 07 hybrid and an 06 minivan. They’re only an expression of my personality to the extent that I don’t care about my car and need something to get from A-B. I don’t flaunt it, and I’ll probably replace it with an older EV because refilling gas is annoying for my dedicated commuter (the hybrid).

    I’d rather ride my bike, but my work is too far away (2 hours on transit, ~1.5 hybrid w/ bike, maybe 1 with a riced ebik, each way), and my reasons for sticking with my employer and not moving are more important than my preference for cycling.

    My mode of transportation is about utility, not expression of personality. I’d drive a truck if it made sense, I just haven’t found one that makes more sense than renting one the 2-3 times per year I need to haul something that doesn’t fit in my minivan.

    When I need to upgrade my car, I’ll find something sensible and maybe remove the parts I don’t like. It’s not a big deal.








  • you hand picked 2 peices from that whole page. The first one when you read the example below doesn’t even fit your case, so you left that out.

    Words have meaning given context, I pointed to the definition that fit the context. When talking about wealth and assets, “money” means anything that could be easily converted to cash. I didn’t copy the first because it wasn’t relevant to the context.

    Then you had to do mental gymnastics to make the second one fit.

    I provided two to drive home the point.

    How about an example. If I said, “how much money does Elon Musk have?”, that would obviously include his stocks and whatnot because he probably only has a few million in actual cash, if that. If you ask how much money I have on the street, I’d assume you’re talking about cash in my wallet, or maybe cash in my checking, and I wouldn’t include my stocks or even savings balance.

    Context matters a lot.

    But when conversing with normal people, you will be hard pressed to find people who agree.

    Are you saying that if I asked how much money you have in your retirement account, you’d say $0 because you only have stocks? If so, that’s really weird.


  • My vote is Podman with an immutable distro, like OpenSUSE MicroOS or Fedora Silverblue. Here are my reasons:

    • rolling base, with very minimal footprint, so you don’t need to worry about upgrades
    • podman runs proper rootless containers, so you get better security vs docker, which tends to run as root (breaking out does less damage if you manage permissions properly)
    • deploying a new service (or moving a service) just means copying configs and running, no concerns about what the host has
    • there’s nothing special about the host, so if MicroOS or Silverblue are abandoned, just copy the configs and data to a new host

    It’s a little more work to set up, but once things are running, it’s drama free. And I think that’s the best thing to optimize for, keeping things boring is a good thing.



  • That is basically Schrodinger’s cat

    No, it’s not.

    Schrödinger’s cat thought experiment is about things where observing state will impact the state. That would maybe apply if we’re talking about something unique, like an ungraded collectible or one of a kind item (maybe Trump’s beard clippings?) where it cannot have a value until it is either graded or sold.

    Stocks have real-time valuations, and trades can happen in near real time. There’s no box for the cat to be in, it’s always observable.

    money

    Look up the definition. Here’s the second usage from Webster:

    2 a: wealth reckoned in terms of money

    And the legal definition, further down on the same page:

    2 a: assets or compensation in the form of or readily convertible into cash

    Stocks are absolutely readily convertible to cash, and I argue that less liquid investments like RE are as well (esp with those cash offer places). Basically, if there’s a market price for it and you can reasonably get that price, it counts.

    When my stocks go down, I may not have realized that loss yet from a tax perspective, but the amount of money I can readily convert to cash is reduced.



  • I’m angry about both, yet still prefer Jellyfin. Why? I control everything about it. I self host it and can choose who has access (including putting it behind a VPN). I have the code so I can patch it if I choose. I can even disable the problematic endpoints of I’m fine with the repercussions.

    With Plex, i have to live with their central servers. With Jellyfin, I don’t, and it’s much less likely a corpo comes after me specifically than happens to see something via a Plex compromise.

    I think both are fine services, and I appreciate Plex’s response here. I still prefer Jellyfin.



  • That’s correct. All salt does is force the attacker to compromise each password individually. Those passwords should still be considered compromised and users should change them everywhere they’re used.

    If you add pepper (random data stored separately from the passwords and salts, like an ENV var or ideally secure hardware device), an attacker would also need the pepper to crack the password correctly, which significantly raises the bar. However, even then it’s good practice to change that password everywhere even if compromise is unlikely, because again, someone could link your login to another compromised site and crack the easier site’s password hash.

    The only reason it’s okay to not recommend a password change is if the password hash database was provably not compromised, but in that case, I’d want details on how they kow that.


  • You missed the part about pepper. Pepper is something that’s added, like salt, but that isn’t stored with the password. A low security version of this is an environment variable, but it could also be a secure hardware device on the machine.

    So it’s more like this:

    • “p@ssword” + “hakf” + “pepper” -> “hifbskjf”
    • “p@ssword” + “jkjh” + “pepper” -> “gaidjshj”

    If an attacker only has the salt, they’ll “crack” the password into something that’s not the original password: brute_force("higbskjf", "hakf") - > "kdrnskk". The idea is that it might take a few days for the attacker to recognize the error, and by then the security team has already responded and locked the backdoor.

    Even if the passwords are peppered, users should assume their password is compromised and change them. But peppering may prevent a cascade effect from reused passwords.