No, we were taught about HTTP, the fundamentals of hypertext and how it gets rendered, how embedded code (Flash at the time; yes, I’m old) runs in the browser, and the concept of the digital footprint. The cybersecurity implications were obvious.

Actually, I have to correct myself. Some of this was taught in the 7th or 8th year of primary school, around ages 12-14. I was fortunate to be born in a country, at the right time, where the public education system was still worth something. My heart bleeds when I hear of what goes on across the ocean.

Not me. Call me old-fashioned, but I prefer organic.

Literally none of that should be surprising for people who have a basic understanding of how the WWW works.

Which, I’m starting to realize, is a depressively low fraction of the general population. I was taught this in middle school, for fuck’s sake.

They removed almost every basic networking feature with a firmware update. Even in “expert mode”, all I can do is set up the wifi and pick a single /24 network from 192.168.0.0/16. I can’t even pick a goddamn DNS server. Unfortunately the other ISPs that serve my area are at least twice as expensive.

One obstacle you might encounter is carrier-grade NAT or CGNAT. Some ISPs put residential subscribers behind an additional layer of IPv4 NAT, which makes your public address inaccessible from the internet. In that case, you’ll either need Tailscale or a similar service, or a VPS to act as a relay.

Then there’s Vodafone who have unilaterally removed both the port-forward feature and bridge mode from their residential cable modems, and I hate them, and wish them a hammer to balls.

i3-4160 running Proxmox (OPNSense VM and a couple of containers) with 3 spinny drives and no GPU, TP-Link 8x GbE switch, ASUS AX1800 as a Wifi AP, ISP’s own manky cable modem, plus a UPS eats about 66-72 watts at the wall socket. If I install a passively cooled GT-710 for transcoding, it adds 10-15 watts at idle.

Removed by mod

you’re conflating me with the author of Cliparr

My mistake, I’ve edited the comment to reflect this. Although I don’t understand, then, why you even brought Cliparr up. You’re not involved, and only taking offence on someone else’s behalf.

That also means that the lovely message of “Ipso facto, for all the AI “Akshually” pedants, I’ve tagged this as AIP. Politely go fuck yourselves :)” was precipitated by a single negative interaction and a handful of downvotes. Regardless of linguistic and cultural differences, that’s just being a dick, and it should be pointed out. Perhaps you should reexamine how you handle criticism.

I don’t see how you were “dunked on”. There was one (1) person who went farther than voicing legitimate concerns… and then you were a twat and a half about it in the edited post. “Politely go fuck yourself” with a smile is worth a downvote.

Developers have been getting criticism for using particular tools for decades. For using Electron, for using systemd, for developing in Rust, for not developing in Rust, for using GTK or Qt… but when LLMs get involved, it’s suddenly verboten and you get to take some reductive moral high ground because “it’s just a tool”?

(edit) Just to answer the actual question:

• If you don’t need to use AI, don’t. Messy, undocumented, human-authored code deserves more respect than clean code with dubious authorship.
• Show how the sausage is made. Don’t just push your project as a single squashed commit; it makes you look like you have something to hide. (edit 2) If a commit contains AI-generated anything, mark it as such.
• Again, don’t be a twat when you inevitably get pushback. As a developer of supposedly 25 years, you should be familiar with that of no particular renown, you should learn how to handle it gracefully before a reputation develops around you.

This will have dire consequences for the trout population.

I have this new AI tool. Free and open source, model and all, and extremely CPU-efficient. Basically you feed it the training data (like some New York Times articles, but it can be any text or binary), and it can produce a 1:1 output when prompted. I call it “copi”; can I get my five trillion tax dollars now?

Early adopters. I work at a university that owns multiple /24 blocks (and probably an entire /16, but no concrete evidence) because they were assigned during the internet’s infancy.

CUPS didn’t work for me as I can’t see an upload option on the web UI.

And you won’t. For the purpose of printing, CUPS is a print server, not a web front-end. It facilitates communication between client devices and downstream printers through a unified open protocol that isn’t manufacturer-dependent.

Printing is implemented through IPP, which is an HTTP-based protocol. You have to add the URL of the printer as it appears on the web UI (e.g. https://print.mydomain.net/printers/PRINTER_NAME) as a printer in the client device’s printer manager. It’s plug-and-play on Linux and Mac, and needs a driver (even if it’s the generic PostScript driver) on Windows.

Now all I need is a way to remotely start a headless session and I can finally nuke X11 off my computer.

The US specifically has settled on it being (effectively?) public domain.

The US Copyright Office has declared that it would not grant copyright protection to AI-generated material due to a lack of human authorship, but it is very far from being codified by law, nor does it say anything about the ownership of the material.

All of the alternatives eventually run into the same “Will my banking app work on it?” problem. The absence of a healthy app economy is the one thing that can’t be fixed by throwing software engineers at it, and it is what caused the death of Windows Phone.

As others have said, Tailscale is the most pragmatic solution. It’s a mesh VPN based on Wireguard. It’s implemented in such a way that you don’t need a static IP and don’t need to open any ports on your firewall. The caveat is that you either need to register an account on tailscale.com (it’s free for small-scale use) or set up a self-hosted alternative like Headscale on a VPS. Then you have to install the Tailscale client on each of the hosts you want to access and log into your account.

Tailscale nodes will be accessible using an internal, private address in the 100.64.0.0/10 address space. You can also set up a split DNS that allows you to access your hosts using a DNS name like hostname.your-tailnet-name.ts.net.

I mean whatever level of access is required to upload an image. That can be access to the web app (with login), access through WebDAV, or access to the underlying OS or filesystem. If you can put a file on Nextcloud, it is sufficient access.

I forgot to mention that the vulnerability can only be exploited if libraw is also compiled with a particular flag that enables the vulnerable feature. That flag is disabled on base Debian. Docker’s service doesn’t test whether the vulnerability is actually present in the image, only that the package version is listed as affected.

Those vulnerabilities are inherited from the Debian base image. Debian is extremely diligent about fixing high-risk vulnerabilities. A high severity CVE does not automatically mean that you are at severe risk. It’s more an indication of how fucked you can be IF the vulnerability is exploited to its greatest potential.

One of the CVEs affects libraw, which is a library for handling RAW photograph files. If a RAW file contains a particular header, and that header is maliciously constructed in a particular way, extracting an embedded thumbnail can allow the attacker to execute arbitrary code on the server. To make that happen, the attacker must either gain access to a device (e.g. camera) you own, or already have access to the server to upload and process the file, which means that security has already failed.

The Swiss cheese model applies to cybersecurity too.

I use Docker Compose to run my Nextcloud server using the community image, which in turn lives inside an unprivileged LXC container.

volumes:
  db:

services:
  db:
    image: mariadb:lts
    container_name: mariadb
    restart: always
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - db:/var/lib/mysql
    secrets:
      - mysql_root_password
      - mysql_nextcloud_password
    environment:
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_root_password
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_nextcloud_password
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: always
    ports:
      - 8080:80
    depends_on:
      - db
    volumes:
      - /var/www/html:/var/www/html
      - /srv/nextcloud:/srv
    environment:
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_nextcloud_password
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=db

secrets:
  mysql_root_password:
    file: ./secrets/mysql_root_password.txt
  mysql_nextcloud_password:
    file: ./secrets/mysql_nextcloud_password.txt

Nextcloud’s file storage is a mount point at /srv/nextcloud, which is backed by a ZRAID pool. The secrets are stored in files with 600 permissions. The web server is initially exposed on port 8080.

When you run the container for the first time, it will show a first time setup dialog. You’ll have to fill it out manually, using mariadb for the database type and db for the database hostname.

If Nextcloud works through HTTP, you can then set up a proxy for HTTPS. I used Nginx running on the same LXC. I can’t guarantee that my config is adequately secure, use it at your own risk.

upstream php-handler {
	server 127.0.0.1:9000;
}

server {
	listen 80;
	listen [::]:80;
	server_name nextcloud.your.domain;
	return 301 https://$host$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name nextcloud.your.domain;
	keepalive_timeout 70;
	client_max_body_size 32G;

	ssl_certificate /etc/nginx/ssl/ssl.crt;
	ssl_certificate_key /etc/nginx/ssl/ssl.key;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers HIGH:!aNULL:!MD5;

	add_header Referrer-Policy "no-referrer" always;
	add_header X-Content-Type-Options "nosniff" always;
	add_header X-Download-Options "noopen" always;
	add_header X-Frame-Options "SAMEORIGIN" always;
	add_header X-Permitted-Cross-Domain-Policies "none" always;
	add_header X-Robots-Tag "none" always;
	add_header X-XSS-Protection "1; mode=block" always;

	fastcgi_hide_header X-Powered-By;

	location / {
		proxy_pass http://127.0.0.1:8080/;
	}
}

To allow the web app to work using the DNS name, you’ll have to edit /var/www/html/config/config.php and change/add these values:

'trusted_domains' => array(
    0 => '127.0.0.1:8080',
    1 => 'nextcloud.your.domain',
    // 2 => whatever other addresses you want to use
),
'overwrite.cli.url' => 'https://nextcloud.your.domain/',
'overwriteprotocol' => 'https',
'overwritehost' => 'nextcloud.ng.local'

If at any point you need to start over, remember to delete the contents of /var/www/html.

(edit) Forgot to mention: the web server will accept connections from all addresses, you’ll need to set up a strict firewall to only allow 443 (maybe 80) and 22.