Surprised to see so much hate towards passkeys. I absolutely love them when I can use them with Bitwarden and my own SSO.
Sucks when I am limited to hardware tokens like yubikeys.
I am even more surprised about the multiple down-votes for this comment just because I like some feature. Must be a bunch of grumpy old keyboard warriors on this thread. 0__o
We had the main community blocklist and several of their pricey paid blocklists enabled in a PoC capacity. We had a lot of legitimate users end up blocked. In some cases these may have been VPN exit nodes, or users on CG-NAT, or devices on a shared network with some other compromised / bot device. I didn't get 100% of the details, just that we were inundated with support requests from real users that ended up blocked.
Given the number of residential proxies I see scraping the couple of sites I have responsibility for I don't find IP address-based blocking useful anymore. That ship has sailed.
Behavioral and client fingerprint analysis (ugh-- having to run Javascript just to view a static site) is the only way (at least until we get user "age" and identity attestation rammed down our throats).
I run an attractive site to AI scrapers and yes the IP ship has indeed sailed in favor of residential proxies. They are non-stop and could have ingested all of our content many times over every day. JA4 is useless too because they have the ability to spoof this or use a very common fingerprint like Chrome that you cannot block without blowback. These bots will only use a given IP a couple of dozen times and then use another node. They use 10s of thousands of IPs. You can tell because they will come in waves from a residential or mobile network
What kind of fingerprinting are you thinking of? JA4? I haven't found a way to do that inexpensively at our scale, but we may have to go that route - looking at CloudFront bot mitigation.
For behavioral, we have Anubis honeypot functionality turned on, but it doesn't seem to be effective for 99% of scrapers. Anubis is also running behind TLS termination, so I don't think it can do full JA4. It does have the less robust JA4H apparently, but I'm not sure how effective that will be.
Edit: Oh yeah, forgot to mention - it's almost 100% residential proxies. Primarily China Telecom and China Unicom. Unfortunately those providers are HUGE and also host a ton of legitimate users all over Asia.
> What kind of fingerprinting are you thinking of?
I'm minding a proprietary application where this is being discussed. The vendor is talking about running Javascript in the client to detect headless browsers, bots, etc. I'm guessing they're going to license something off-the-shelf. The technical specifics aren't being discussed. They're at the "wow the stakeholders" phase.
I'd like to do something ourselves but, at the size of the org I'm talking about (with virtually no in-house dev resources), COTS rules the day.
I have been on the same Arch installation for 10+ years and the previous install on a different device was also ~8 years old. Could have just transferred files over and be done about it but I wanted to refresh my knowledge. :)
In the age of LLM agents, still going for Docker/Podmam on anything besides local development box seems like a weird choice.
Docker has poor tooling for network level security between the containers, has issues with different runtimes per container, etc.
It is just a bit primitive if you want to expose multiple services to the internet on the same server. One of those apps will get compromised and then all the others will follow.
If you want a decent self hosted server, ask your frontier LLM agent of choice to configure kubernetes (on something like k3s) with mandatory userns mapping so nothing runs as root on the host, default deny firewall so inter-container communication is as locked down as possible, and if your router supports, set up VLANs so none of the containers can access your other devices on the LAN. Use something like backrest to handle backups, alertmanager and Grafana for monitoring, Keel for auto updates. Also consider separating ingress for public and internal services and use Tailscale with split DNS to acces the internal entrypoint. Set up Crowdsec as WAF and subscribe to their free blocklists to filter out bots. Ask it to set this all up using Ansible, so it can be maintained.
While this would be extremely time consuming to set up and maintain by hand, an agent can do and test it in a few hours.
Kubernetes supports multiple pluggable container runtimes per node. Can be quite useful when requiring some virtualization or running certain docker-in-docker scenarios for CI/CD workers. Maybe it can be done with Docker as well these days, but with kubernetes it is out of the box support.
Perhaps you could manually set up some VLANs and set up Docker networking to use those, but that has to be custom setup, none of that is a standard feature of Docker.
So instead of having to reinvent the wheel for each of those problems, you can just take kubernetes instead. And while it is a lot to learn, LLMs can make it a lot easier to do. For years I was running docker-compose stacks for self hosted things, but I replaced that once LLM agents became a bit less stupid. :)
Yes, kubernetes makes it much easier to configure proper firewall through network policies.
Docker has networks but there is no good options to limit it beyond those and it is extremely basic and basically leaves everything open between your proxy and app.
Because it still doesn't fully support all of the hardware on M1. I know it because I used Asahi while I had M1. Now I have M4 for work and it doesn't support Asahi at all.
I just use Linux PC as much as possible instead. And that 4$ M4 is just a fancy presentation computer I use when I travel.
Personally I would spend thousands on an actually great Linux laptop, but there are still none around.
Up to the M2 series are supported pretty much fully. There are a few exceptions, but it does work quite well. I'd need a good reason to grab an intel/amd laptop just for running linux.
I bought my first minisplit ~4 years ago since none of the contractors were available in the hot summer.
I bought the tools as well (vacuum pump, manifold, pipe cutters, etc.).
It cost me ~650$ total.
The next time I bought a minisplit (3.5kW one), I already had the tools and it cost me only 450$. A proper one meant for use during harsh winter would probably costs a bit more though, at around 1000$.
So I have set up a few of them for my family and friends so far. The units come pre-charged with gas for ~5M of ducts, there is nothing hard to set them up.
I also set up ESP32 controllers so I could attach them to Home Assistant, bypassing any Chinese cloud apps, etc.
>160 hours of education/vocational training and 2 years’ verifiable experience in the trade
To get the license to install minisplits (two years experience generally means working an apprenticeship).
It's no wonder install costs are so much in the US. And as you've experienced, they're hardly rocket science to install. The 160 hours training would be more than enough, I'm not sure why 2 years experience gets tacked on the end.
I don't want just anyone with some tools competing with them. This is a machine full of gas that is awful for the environment. And yes, I'm well aware that in developing countries, a lot of installers just vent coolant into the atmosphere during install rather than doing it properly.
Sure, so have them take a week-long course and register with the county and get a license. 160 hours of class and 2 years of apprenticeship means you have to find someone to apprentice _to_, so the incumbents get to gatekeep how many competitors they're willing to have, and limit it to only the people they like.
Unless your state is very unusual that is the requirement for installing them for other people as a tradesman. In most states if you are DIY for yourself all you legally need are the electrical permits for the wiring hookup (which for DIY don't require that "apprenticeship").
Nothing because the political optics of doing anything are bad ad the last thing they want is to create a victim that causes people to ask the question why the rules are even written how they are.
Environmental law is the same way. You're mostly (details depend on jurisdiction) not supposed to pave anything without getting permission but if they pushed the issue on everyone who put a pad under their car port the rules would get changed.
They also don't 100% enforce the speed limit either.
There are people on here who live in this fantasy world where all house work is permitted and performed by licensed tradespeople which is... counterfactual.
Insurance would still cover this stuff. You sound like you came here from Reddit, where everyone is convinced that if you DIY anything, your insurance is entitled to deny claims.
Your insurance will pay up. Then they will consider terminating your contract. DIY work in your home does not invalidate insurance claims. This is ludicrous claim. You could go read your insurance contract in five minutes and verify.
This kind of thing is right up there with calling dig safe before a project that will be exclusively hand excavated. At some point you're basically just paying to circle jerk it with the other boot lickers in the office or at the cocktail party over how much you paid for no reason just because the rules that will never be enforced say you ought to.
I did and then rolled back. Gitea is far ahead in CI/CD features, which is the main thing I want from my own git forge.
And they also seem to keep adding more meaningful features, not just refactoring to keep some federation thing working.
There is a safe mode built in. If you enable it and you loose connection to the router due to some misconfiguration, it will reset within 15 minutes to the point of where you started the safe mode session. Also if you mess up the IP layer, there is a chance that you can still connect and configure RouterOS through their WinBox program using the mac address.
reply