A software developer and Linux nerd, living in Germany. I’m usually a chill dude but my online persona doesn’t always reflect my true personality. Take what I say with a grain of salt, I usually try to be nice and give good advice, though.

I’m into Free Software, selfhosting, microcontrollers and electronics, freedom, privacy and the usual stuff. And a few select other random things as well.

  • 4 Posts
  • 818 Comments
Joined 5 years ago
cake
Cake day: August 21st, 2021

help-circle


  • Thanks for the link! As a short aside for the other people here: Try not to spam developers. That usually achieves the opposite and makes them miserable, when we want them to not burn out, and write good software for us. A thumbs-up emoji is the correct reaction for the average person. Or for the pros - a code-review highlighting specific issues within the code.



  • I feel Anti-DDOS and Cloudflare as a web application firewall has traditionally been a lot of snake-oil as well. Sure there’s applications for it. Especially for the paid plans with all the enterprise functions. And all the way at the other end of the spectrum, where it serves as a means to circumvent NAT and replace DynDNS. But there’s a lot in-between where I (personally) don’t think it’s needed in any way. Especially before AI.

    From my own experience, personal blogs, websites of your local club, church, random smaller projects, small businesses… rarely need professional DDoS protection. I’ve been fine hotsing it myself for decades now. And I’m not sure if people know what they’re paying with. I mean everytime we get a Cloudflare hiccup (or AWS…) we can see how the internet has become very centralised. Half of it just goes down for an hour or so, because we all rely on the same few, big tech services. And if you’re terminating SSL there, or use it to look inside of the packets to prevent attacks, you’re giving away all information about you and your audience/customers. They don’t just get all metadata, but also read all the transferred content/data.

    It all changed a bit with the AI crawlers. We definitely need countermeasures these days. I’m still fine without Anubis or Cloudflare. I block their IP ranges and that seems to do most of the job. I think we need to pay a bit more attention to what’s really happening. Which tools we have, instead of always going with the market leader with the biggest marketing budget. Which problems we’re faced with in the first place and what tools are effective. I don’t think there’s a one size fits all solution. And you can’t just roll out random things without analyzing the situation properly. Maybe the correct answer is Cloudflare, but there’s also other way less intrusive and very effective means available. And maybe you’re not even the target of script kiddies or annoyed users. And maybe your your convoluted Wordpress setup isn’t even safe with the standard web application firewall in front.

    Anubis is an entirely different story. It’s okay concerning privacy and centralisation. It doesn’t come without downsides, though. I personally hate if that thing pops up instead of the page I requested. I don’t like how JavaScript is mandatory now to do anything on the web. And certain kinds of crawler protection contribute to the situation how we can’t google anything anymore. With all the people locking down everything and constructing walled gardens, the internet becomes way less useful and almost impossible to navigate. That’s all direct consequences of how we decide to do things.


  • This is the permissive vs copyleft debate. And it’s old as time. I suppose there’s a lot of nuance with licensing. If you’re a company at the receiving end, you probably love permissive licenses. They’re easy, offer the maximum amount of flexibility and freedom. It’s so short you probably don’t even need a team of lawyers… If you write software, it’s a bit more complicated. Do you want to cater to those people, make it as easy as possible to adopt your software? Then maybe consider BSD/Apache/MIT. Do you want to build a community, stop your competitors from just taking code? Want to try to ensure it stays open? Then maybe consider a copyleft license.

    I sometimes don’t care. Write some stuff for me (as a hobby) but that’s my entire motivation. I don’t care what people do with the results of my weekend of effort. Never plan to hire a lawyer or bother with it in case something happrns with it. Or it’s just a pile of snippets. I’ll dump it for other people to use and release that either WTFPL or some other permissive license. People can do whatever they like with it. With the stuff I’m a bit more proud of, or I plan to return to, I’ll choose AGPL.

    I suppose with operating systems, it’s a bit similar? I mean there is a community for both ideas. Seems there are people who like either of them. They’ll have slightly different ideology, tasks to accomplish and different goals.



  • Hmmh. I’m not entirely satisfied with any of them. Crowdsec is a bit too complex and involved for my taste. And oftentimes there’s no good application config floating around on the internet, neither do I get any sane defaults from my Linux distribution. Whereas fail2ban is old and eats up way too much resources for what it’s doing. And all of it is a bit too error-prone(?) As far as I remember I had several instances when I thought I had set it up correctly, but it didn’t match anything. Or it was looking for some logfile per default but my program wrote to the SystemD journal. So nowadays, I’ll double-check everything. I wish programs like sshd and webapps came with that kind of security built in in some foolproof way.






  • “Hey, I never liked Office 365, Microsoft as a company and all the Cloud shenanigans… And have you noticed how their products all become shittier and more invasive by the day? All while they increase subscription price each year now to finance all the AI stuff I rarely use? I’m a long-term fan of this other product, called XYZ which is just better in every aspect. No offense. If you want me to send you a link…”

    (Edit: It’ll become easier after a while. At some point they all know you’re a Linux nerd and disassembled your wifi router at home, dishwasher… To get rid of proprietary spy components. And people will deliberately decide to listen to your opinion and lengthy rant, or make an effort to not bring up the topic 😆 At that point, you’re relatively free to speak your mind… Just read the room a bit. The goal isn’t to annoy people.)