Yes, and that’s what I disagree with. Neither AI nor scripts will make a script kiddie into an actual hacker.
“AI makes hacking easy” is like saying “building houses is now easy because we have cranes”. Sure, but if you jump into a crane without knowing what you’re doing it’s not magically going to make a house appear.
Ah I agree it’s easier to hack. What I don’t agree with is the notion that it enables a class of people that couldn’t hack before. It’s easier to hack, yes, but for the same people who were hacking before.
Ignorant people trying to use ready-made tools for hacking isn’t a new thing, it goes back a while, there’s even a term for it (script kiddies).
I expect it’s a common trend though, people generally use Dropbear on embedded devices for the same reasons they prefer Alpine, it’s more compact.
That’s because it turns out there are tons of vulnerabilities out there introduced by very lazy and/or dumb code.
It isn’t that AI has lowered the bar for hacking, it’s that it’s showing us just how much bad code is out there. The bar was already on the ground, we just didn’t know it.
After all is said and done AI will actually end up raising the bar for security everywhere.
Unfortunately we have a lot of legacy crap to clean first.
Most Android apps that make a ssh server use dropbear afaik.
I mean, anybody who’s still using password login for SSH is kind of asking for it.
It’s not quite as simple as that. The author in this case followed a pretty specific trail to find the bug.
Where AI helped was as the last step. They already knew what the bug would do and where to look, but actually looking through the source code for all the possible musl implementations out there would have taken a lot of time.
So they brute-forced it instead and asked AI to spin up actual running instances of all those implementations and simply tried the bug against each of them, rather than looking at all the code.
Unless it’s explicitly installed no. The default Alpine image doesn’t come with OpenSSH.
Yeah it’s a big pile of crap. More details here if anybody’s curious:
https://www.reddit.com/r/AskAGerman/comments/1t4pio6/how_are_germans_ok_with_schufa/
OP is in Germany where they have a private database called Schufa that pools information about you collected from banks, mobile carriers and internet providers, and provides a “score” to them as well as to landlords.
It’s borderline legal under GDPR because it doesn’t actually store anything about things like nationality, employment, religion, marital status or sensitive financial information like income, assets, expenses.
The score is based on things like loan existence & repayments, ongoing utility contracts (with privately owned companies), if you’ve filed for insolvency, how often 3rd parties inquire about your score and other circumstantial data.
Generally speaking you’re correct, in most countries there are very clear rules about loans that are based on what other loan repayment you have vs what’s your current income, and there are rules about how far much debt you can take as a ratio of the two (say, you can’t take a new loan if you’re already using 60% of your income to repay previous loans).
Also, the information about loans is typically restricted to this exact inquiry: can this person get a new loan (yes/no) and if yes what’s the maximum they allowed to repay per month (X euro). So the bank knows they can structure a loan to you based on a repayment of up to X per month, but nothing else.
I’m guessing Germany doesn’t have regulation like this (since accessing any information about your income and expenses is forbidden), so Schufa was created to be a (poor) substitute.
I don’t computer enough to host my own site.
You mean savvy or cost?
If it’s cost, you can have a simple site and email with your own domain for something like $30 a year.
I cut lawns and maintain gardens,
Do you own your rake and gloves or rent/borrow them?
It’s the same thing having a domain. Really basic but essential tool that it makes sense to own it and have no surprises or changes at anybody else’s whim.
Your business email is a @proton.me address?
You mentioned a website, wouldn’t you rather have an address @ your website domain?
AFAIK the concept behind keepassxc is that it’s an encrypted .kdbx file that you sync yourself among your devices by any means you can. There are official apps for Windows/Linux/Mac, browser extensions for Firefox/Chrome/Chromium/Vivaldi, there’s integration with ssh-agent, and 3rd-party apps for Android and iOS.
decided that scraping the internet for fanworks and hosting them on a new site without asking permission from any of the creators was a good idea
The thing is, in any fetish and fanfic community there will be a body of works accumulated over the years that contains many classics but the authors are only a nickname. Sometimes there’s an email listed that stopped working decades ago.
The sites that host the works are usually run by enthusiasts. Over the years they lose the incentive to maintain them. Whenever a site goes down and others take its place there’s always a dilemma about what to do with that body of work.
Technically speaking, yes, any site that’s not the site where each author originally uploaded their work is in breach of copyright and/or licensing for those works. On the other hand, if you were to attempt to contact each author and only carry forward the works where you get an answer and permission… only a tiny fraction would qualify, and massive portions of the literature would be lost in each move.
A big PSA here is to have them pass you the device activation link that pops up when they first start Tailscale, and activate their device on your tailnet.
Then you tag it, write an ACL rule for it (or you probably already have a rule for Jellyfin clients connecting only to the Jellyfin server on your tailnet by now, so just the tagging is enough) and that’s it.
MUCH simpler than having non-savvy people attempt to set up a Tailscale user account. Plus, you can only have 6 users in a free tailnet but you can have 100 devices.
Clementine
Whoa, has Clementine picked up again? I’ve long ago switched to Strawberry and then to Fooyin.
As someone who’s used all three (moved from Plex -> Emby -> Jellyfin):
Plex’s killer feature is the relay and the fact it’s completely transparent for users. You log in with a Plex client (whatever device, whatever location in the world) and it will sort out a connection to the Plex server. Complete no-brainer.
Jellyfin has been killing it lately, the last 3 versions (10, 11, 12) were all amazing leaps forward. The devs have been really hitting their stride and are addressing fundamental design issues and making Jellyfin better from the ground up. If you want complete independence, openness and control, excellent performance, this is it.
Emby for me sits somewhere in-between and it’s not necessarily the better off for it. Feels like a compromise or the worst of both worlds. It has touches of Plex’s enshittification streak, it hasn’t addressed any of the core problems like Jellyfin has.
Both Emby and Plex have issues navigating VPNs and complex/unusual network setups because their plug’n’play approach relies too heavily on autodetection. Plex has the relay to fall back on (provided you pay for it) but Emby doesn’t.
Both Emby and Plex will move features around and really, really want you to keep paying so it’s anybody’s guess what you’ll be paying for from month to month. Lifetime passes were (can I say it?) a tremendously STUPID idea and now that ship has sailed anyway.
IMHO, one of these days someone will come up with a way for Jellyfin to provide free, transparent, aecure client+server pairing behind NAT and that will be a huge blow to both Plex and Emby.
You can appoint multiple accounts as administrators at Migadu, provided you’re not on the Micro plan.
Another option would be the “pattern rewrites” feature of Migadu. It’s a sort of “wildcard alias”. You, as admin, can define an alias with a asterisk in it (let’s say bla.*@) for one of the wife’s mailboxes, and she could give out addresses with the asterisk replaced by anything she wants (bla.amazon@, bla.ebay@ etc.)
You can define more than one such wildcard pattern, you could make for her shop.*@, bank.*@, bills.*@, social.*@, and so on, a pattern for every occasion.
She would still not be able to edit these aliases but she would be able to make them up on the fly (as long as they match the fixed part of a wildcard). You can even send from these aliases (you simply use them as your “From” address in the mail client).
You can do what you want with IMAP too.
I use isync, it’s a CLI tool that can sync between IMAP accounts or between IMAP and local plain storage and it has the option to delete messages over a certain age after it copies them.
Is there a set up where some remote service handles email exchange, and you just sync with it
Any regular email provider can do this as long as it offers IMAP. I use email clients with my provider’s IMAP but I also use isync on the server to periodically pull all email locally and delete messages older than 30 days. I’ve also installed a local private IMAP server and a private webmail client on top of that private IMAP, which I use to search through old emails.
This way I normally use the “live” mailbox with my PC/mobile devices, and use the private webmail when I need to search for anything over 30 days old.
What I do is not “selfhosted email”, technically speaking, because I rely on the live IMAP and SMTP from a provider. But I can switch provider at any time because all my email is @ my custom domains, so I can simply point my DNS to another provider and update my apps to use the new provider’s IMAP/SMTP server.
One problem is that it’s not much use applying secondary auth methods on the server side if the mobile app can’t use them.