I blow hot air.

  • 4 Posts
  • 58 Comments
Joined 1 year ago
cake
Cake day: July 6th, 2023

help-circle











  • If you’re worried about unauthorized access to the physical machine, you could always just do disk-level encryption instead or store the app’s data in something like a Veracrypt virtual disk. They’d still be able to access the data if they go through your OS/user, but wouldn’t pick anything up by accessing the drive directly.

    Nothing short of E2EE can truly stop someone from accessing your data if they have physical access to the server, but disk encryption would require a targeted attack to break, and no host is wasting their time targeting your meme server. I seriously doubt they’d access it even if you had no encryption at all, since if they get caught doing that they’d get in a heap of legal trouble and lose a ton of business.





  • All these answers read like they’re written for comp sci students rather than a general audience. Let me give an ELI5 (more like ELI12) a shot.

    Ports are just numbers. They aren’t physical pathways or doors or windows or anything like that. A better analogy is a street address, like an apartment number. Your IP address identifies your computer (apartment building), and the port identifies the program on the computer (the apartment). When a program needs to talk to the internet, which is very similar to sending a letter, it hands a packet/letter to your computer and your computer assigns the program a port number. It then puts that number on the return address of the letter so that the recipient knows where to send the response. The computer remembers that port number is associated with that program, so when it gets an incoming letter with that number, it gives it to the program. After the program is done talking to the internet, the computer frees the port up to be used by another program.

    Ports are “closed” when there is no program associated with them. Any incoming letters are ignored because they have nowhere to go.

    Ports are “open” when they’re associated with a program. This happens automatically when programs send outgoing letters, or you can manually open (or “forward”) ports by telling your computer/router what the port should be associated with and that it shouldn’t use the port for something else.

    ELI5 over.

    The internet is networks on top of networks on top of networks, so your computer will have an IP and assign a port number, then your router will remember that and change the address on the letter to its own IP with a different port number, then that process repeats a few more times until eventually it reaches its destination. You don’t have to deal much with your computer’s internal network, but occasionally you have to deal with your router’s by opening/forwarding a port because it has a NAT that has to deal with all of the devices on your network. Forwarding the port just tells your router to always send incoming letters with that port number to a specific device.



  • Is each instance like another person with a server?

    Yes.

    Could that person just shut it down whenever they wanted to?

    Yes.

    Are there any companies that have invested in hosting Lemmy/ other fediverse servers?

    Idk, they’d be very niche.

    Sorry I’m sure I messed up some of the terminology, I hope my questions make sense!

    Nah, you pretty much nailed it.

    Lemmy, and a lot of the fediverse, functions very similarly to email. Gmail can send emails to Proton even though they’re hosted by two completely separate companies. A post/comment/vote/interaction is like an email in that a copy of every interaction is sent to every federated instance, like emails sent to recipients. This creates a lot of redundancy and traffic between instances, which has its pros and cons.


  • Podman is purposefully built to rely on systemd for running containers at startup. It ties in with the daemonless and rootless conventions. It’s also nice because systemd is already highly integrated with the rest of the OS, so doing things like making a container start up after a drive is mounted is trivial.

    Podman has a command to generate systemd files for your containers, which you can then use immediately or make some minor tweaks to your liking.

    I use podman for my homelab and enjoy it. I like the extra security and that it relies on standard linux systems like systemd and user permissions. It forces me to learn more about linux and things that apply to more than just podman. You can avoid a lot of trouble by running the containers as root and using network=host, but that takes away security and the fun of learning.


  • From Signal’s blog footnotes:

    Usernames in Signal are protected using a custom Ristretto 25519 hashing algorithm and zero-knowledge proofs. Signal can’t easily see or produce the username if given the phone number of a Signal account. Note that if provided with the plaintext of a username known to be in use, Signal can connect that username to the Signal account that the username is currently associated with. However, once a username has been changed or deleted, it can no longer be associated with a Signal account.