Fuckers.

Well i have the rp as i only want one port exposed. I have separate networks per service too to isolate things. Only the things that need to talk to each other can.

My stuff is only accessible on the lan and via the vpn and even then only certain ips have access to certain things.

In your case it might be different , but generally a reverse proxy is better as you can have a single point of access to secure and you are not exposing all of your ports to the host or the internet.

You can use a ddns such as duckdns or host on github pages with jekyll or something

Debian on the host and everything else in containers

I have the arr stack connected to gluetun doing its thing and then wireguard on the host. I only expose my reverse proxy to the host and can connect to the services through that.

Note the networks below, vpn_net allows it to talk to the gluetun network which has the other stuff. The gluetun and arr stuff are in a separate compose file that defines the network. Then the non vpn stuff connects to that network when it comes up

nginx: 
    image: nginx:1.25.4-alpine-slim
    container_name: nginx
    restart: always
    volumes:
       - /etc/letsencrypt/:/etc/letsencrypt/
       - ./nginx/nginx.conf:/etc/nginx/nginx
       - ./nginx/conf/:/etc/nginx/conf.d/:ro
       - ./nginx/htpasswd:/etc/apache2/.htpasswd:ro
       -  /var/log/nginx:/var/log/nginx/
       - ./www/html/:/var/www/html/:ro
       - ./content/Movies:/var/www/media/Movies:ro
       - ./content/Shows:/var/www/media/Shows:ro
    ports:
       - 443:443
    security_opt:
      - no-new-privileges
    networks:
      - reverse-proxy_service1
      - reverse-proxy_serviceN
      - vpn-stack_vpn-net
    depends_on:
      - service1
      - serviceN

I do monthly backups with cron and tar and syncthing for my containers.

I do quarterly backups of my server (14TB) to external USB HDDs. This is done via a script that mounts the drives, runs rsync to copy, then unmounts the drives again and emails me when it is done. I dont bother encrypting them as it ia mainly just media.

He can go suck a lemon

Looks great! Well done

I wonder how long it will be until they see elected representatives as inefficient. 🙄

They should threaten to leave the UK in response.

Sure if you browse by github but in my use of the site over the years I go to the repo from the webpage of the project or from another source such as a link from a blog or something.

Personally I just throw my roms in directories and serve them from nginx. Its easier to just pull them down on deck that way and requires no extra effort or maintenance on my end.

Everything else is on steam.

They must have something to hide 🤨

Imagine paying for an OS to have ads in it. 🐃💩

Thankfully we have Linux/BSD

It doesn’t matter that you can disable it, this stuff shouldn’t be in the OS in the first place

Kdeconnect works great too if you are using linux and android

I’m curious to know about the distro maintainers that were running bleeding edge with this exploit present. How do we know the bad actors didn’t compromise their systems in the interim ?

The potential of this would have been catastrophic had it made its way into the stable versions, they could have for example accessed the build server for tor or tails or signal and targeted the build processes . not to mention banks and governments and who knows what else… Scary.

I’m hoping things change and we start looking at improving processes in the whole chain. I’d be interested to see discussions in this area.

I think the fact they targeted this package means that other similar packages will be attacked. A good first step would be identifying those packages used by many projects and with one or very few devs even more so if it has root access. More Devs means chances of scrutiny so they would likely go for packages with one or few devs to improve the odds of success.

I also think there needs to be an audit of every package shipped in the distros. A huge undertaking , perhaps it can be crowdsourced and the big companies FAAGMN etc should heavily step up here and set up a fund for audits .

What do you think could be done to mitigate or prevent this in future ?

I found this for the wiki on wayback machine

https://web.archive.org/web/20240229133916/https://github.com/citra-emu/citra/wiki

Thanks. I dont know if I have the time for 1000 episodes though 😅

Anyone know the source for this ?

I doubt it, they need to leave the scene as part of the deal. Could they come along and do something anonymously , sure but I doubt its worth the risk to them.