This advice may not have been funded by the Feline Mafia, but it wouldn’t sound any different if it was.
- 0 Posts
- 21 Comments
Specifically these issues: https://github.com/jellyfin/jellyfin/issues/5415
The big one is that video/audio playing endpoints can be used without authentication. However, you have to guess a UUID. If Jellyfin is using UUIDv4 (fully random), then this shouldn’t be an issue; the search space is too big. However, many of the other types of UUIDs could hypothetically be enumerated through brute force. I’m not sure what Jellyfin uses for UUIDs.
frezik@lemmy.blahaj.zoneto World News@lemmy.world•Tesla sales drop in Europe for fifth month in a rowEnglish1·2 days agoThe Mini EV is in the US, but its range is just adequate. Then there’s older models, like the Bolt or Leaf. Ford has an EV Transit van for commercial customers, but its range also sucks.
Hyundai Ioniq 6 is out there, at least.
Yeah, the US market for EVs is bad. Just SUVs and trucks with few exceptions. Not even a good (mini) van.
frezik@lemmy.blahaj.zoneto Lemmy Shitpost@lemmy.world•Hard times call for hard decisions.3·2 days agoBe the reason they had to put up a sign.
Maybe not in this case, though.
Why I change my own oil. Not because I save money–generally don’t even before your time is factored in–but because I know how to put on an oil pan bolt without cross threading it.
It just needs to be clear and set close to the max fill line. If it’s low and/or dark, it wasn’t done right.
Alternatively, if you’re in a place dedicated to oil changes, you can assume it wasn’t done right.
Nah, setting non-standard ports is sound advice in security circles.
People misunderstand the “no security through obscurity” phrase. If you build security as a chain, where the chain is only as good as the weakest link, then it’s bad. But if you build security in layers, like a castle, then it can only help. It’s OK for a layer to be weak when there are other layers behind it.
Even better, non-standard ports will make 99% of threats go away. They automate scans that are just looking for anything they can break. If they don’t see the open ports, they move on. Won’t stop a determined attacker, of course, but that’s what other layers are for.
As long as there’s real security otherwise (TLS, good passwords, etc), it’s fine.
If anyone says “that’s a false sense of security”, ignore them. They’ve replaced thinking with a cliche.
The future conservatives want is the same except it’s men in fashy uniforms. We don’t even have to speculate or joke; it’s exactly how mines are run in countries without worker protections.
Conservatives don’t make that distinction. Though OP does lean into Poe’s Law.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•You're not alone: This email from Google's Gemini team is concerningEnglish5·3 days agoThere are ways they can work around it, but their lead developer was drafted into their country’s military. Ultimately, they’re going to have to make their own phone, and it looks like they’re making plans to do that.
For now, it’s fine.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish2·3 days agoAnd they purposely hobbled certain things people want, like inline links and images. Some clients will do it anyway, but it’s against the collective wishes of the developers.
If I wanted to track people on Gemini, I could totally do it. It’d just be in a more server-to-server way than how its evolved on HTTP (pixel trackers and such).
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish4·3 days agoSome people haven’t lived through the time when HTML layout was done through nested tables, and it shows.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish2·3 days agoMaybe we could have
No-JS
andNo-Client-Storage
(which would include cookies) headers added to HTTP. Browsers could potentially display an icon showing this to users on the address bar.Theoretically, browsers could even stop from the JS engine from being started for the site in the first place. Though I wouldn’t be surprised if the engine is too tied into the code of modern browsers for that to work.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish2·3 days agoLet’s not. It’s a terrible protocol with amateur design errors.
frezik@lemmy.blahaj.zoneto Mildly Infuriating@lemmy.world•The people who voted for Zohran Mamdani are also taxpayers.English8·3 days agoSo I’m aware there is a right-libertarian argument at work here that frames all taxes, always, as “stealing”. However, there’s an argument here that can be used along more democratic socialist lines.
Taxation in representative democracy is legitimate when the democracy itself lives up to the terms. We have come to some kind of consensus as a society on the level of taxation and where that money should go. When we do that, and we say the road is “our road”, we mean that in a literal way. A part of the fruits of our labor were diverted to build that road, and we get a say in how it works.
The US is not a democracy that lives up to the term. “Taxation is theft” is correct in this context.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish2·4 days agoJS does a lot of crap that didn’t need doing in the first place. It can be used in a way that improves performance and user experience, but what’s out there is so far from that.
HTML could maybe be replaced by a specific form of Markdown (one with a real spec), but meh, whatever. Gemini did that, but its limitations are a little too much.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish11·4 days agoWas never part of the standard.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish31·4 days agoYou want to do what Gemini did. Take Markdown, add some specific features to make up for some blind spots in the original, formalize it, and give your version a specific name.
frezik@lemmy.blahaj.zoneto Technology@lemmy.world•No JS, No CSS, No HTML: online "clubs" celebrate plainer websitesEnglish10·4 days agoSomeone will thank you for your service. Not me, but someone.
It’s a historical way to be a socially acceptable introvert. The point isn’t necessarily to catch anything. It’s to have an excuse to be alone with your thoughts.