Account portability is the major reason why we chose to build a separate protocol. We consider portability to be crucial because it protects users from sudden bans, server shutdowns, and policy disagreements. Our solution for portability requires both signed data repositories and DIDs, neither of which are easy to retrofit into ActivityPub. The migration tools for ActivityPub are comparatively limited; they require the original server to provide a redirect and cannot migrate the user’s previous data.
Other smaller differences include: a different viewpoint about how schemas should be handled, a preference for domain usernames over AP’s double-@ email usernames, and the goal of having large scale search and discovery (rather than the hashtag style of discovery that ActivityPub favors).
In the Fediverse your account and identity is linked to a domain (e.g. you are @someone), and you can’t move that account somewhere else. You can’t even change the domain of a server, because all the accounts on that server would be known by a different domain and be treated as separate new identifies. In Bluesky your identity is basically a random number, it’s shown in the URL of a profile page for example. You can link that to a domain temporarily and get a nice user handle, but you can always move to another domain later. That means you can migrate between servers and keep all your friends and followers, something that’s currently not possible in the Fediverse.
The thing about schemas is a technical detail, not really any consequences for users. Then there is a different format for user handles, so the Bluesky people don’t like the double @ signs for those.
The last thing is about how you don’t just pick one server/instance in Bluesky, instead you can pick different servers for different things. One server hosts your account, but a few others can fill and sort your news feed, block spam for you or let you search through content. It’s supposed to create an open ecosystem for these services, and allow you to keep your account on a server that offers none of these by itself, e.g. a small home server. Of course there is nothing like that in the Fediverse, you pick a service and a server, and that’s it.
I have to say Bluesky looks extremely interesting from a technical perspective, there’s just the fact that it’s completely dominated by the official server right now. People can create their own servers though, so we’ll have to see how it evolves.
The decision was made the moment Bluesky chose to deliberately be incompatible with ActivityPub. They want the AT protocol to exist in their own domain because they know the moment they put the screws to monetize, users will flock to an instance where they don’t.
Not sure I get this one. You can still run a website with http. Now it might alarm the browser and users. But you can do it.
As for certificates being free but maybe not now. It's actually the other way round. As I recall when https was pretty new the main way was via verisign, and it was not cheap to get one.
The fact you could later get one for free for example via letsencrypt is what made it so everyone could run https (along with the changes that allow multiple certs on a single server with multiple domains).
If it became expensive to get certs again I'd bet a lot of hobbyist stuff would go back to http or self signed and browsers would need to tone down the warning. But, I cannot imagine that happening now. Having most sites encrypted is a good thing.
Passkeys: how do they work? No, like, seriously. It’s clear that the industry is increasingly betting on passkeys as a replacement for passwords, a way to use the internet that is both more secure and more user-friendly. But for all that upside, it’s not always clear how we, the normal human users, are supposed to use...
Passwords are known (or accessible in a password manager) by the user and the user gives one to a site to prove they are who they say they are. The user can be tricked into giving that password to the wrong site (phishing).The site can also be hacked and have the passwords (or hashes of the passwords leaked), exposing that password to the world (a data breach).
With passkeys, the browser is the one checking that it’s talking to the right site before talking by making sure the domain name matches. Passkeys also don’t send a secret anywhere but instead use math to sign a message that proves they are the returning user. This security is possible because there is a public key and a private key. The user is the only one with a public key. The authenticity of the message is guaranteed by math by checking it with the public key that the user provided to the site when they registered their passkey. The site doesn’t need access to the private key that the user has to verify the message so there’s nothing sensitive for the site to leak.
In practical terms, instead of having to have your password manager autofill the username and password and then do some kind of second factor, it just signs a message saying “this is me” and the site logs you in.
Instance can block bridge domain and it will not be federated
I was referring to the
Put the text #nobridge in your profile bio, refresh your profile on your user page, and Bridgy Fed will stop bridging your account. Or feel free to send me a request privately.
I’m curious as to why someone would need to do that short of having a bunch of users and a small office at home. Or maybe managing the family’s computers is easier that way?...
I don’t have a ton of users, but I have a ton of computers. AD keeps them in sync. Plus I can point services like gitea and vCenter at it for even more. Guacamole highly benefits from this arrangement since I can set the password to match the AD password, and all users on all devices subsequently auto-login, even after a password change.
Used to run single domain controller, now I have two (leftover free forever licenses from college). I plan to upgrade them as a tick/tock so I’m not spending a fortune on licensing frequently
With native Windows clients and I believe sssd realmd joins, the default config is to cache the last hash you used to log in. So if you log in regularly to a server it should have an up to date cache should your DC cluster become unavailable. This feature is also used on corporate laptops that need to roam from the building without an always-on VPN. Enterprises will generally also ensure a backup local account is set up (and optionally auto-rotated) in case the domain becomes unavailable in a bad way so that IT can recover your computer.
I used to run in homemade a Free IPA and a MS AD in a cross forest trust when I started ~5-6y ago on the directory stuff. Windows and Mac were joined to AD, Linux was joined to IPA. (I tried to join Mac to IPA but there was only a limited LDAP connector and AD was more painless and less maintenance). One user to rule them all still. IPA has loads of great features - I especially enjoyed setting my shell, sudoers rules, and ssh keys from the directory to be available everywhere instantly.
But, I had some reliability problems (which may be resolved, I have not followed up) with the update system of IPA at the time, so I ended up burning it down and rejoining all the Linux servers to AD. Since then, the only feature I’ve lost is centralized sudo and ssh keys (shell can be set in AD if you’re clever). sssd handles six key MS group policies using libini, mapping them into relevant PAM policies so you even have some authorization that can be pushed from the DC like in Windows, with some relatively sane defaults.
I will warn - some MS group policies violate Linux INI spec (especially service definitions and firewall rules) can coredump libini, so you should put your Linux servers in a dedicated OU with their own group policies and limited settings in the default domain policy.
I don’t have an immediate answer for you on encryption. I know most of the communication is encrypted in flight for AD, and on disk passwords are stored hashed unless the “use reversible encryption field is checked”. There are (in Microsoft terms) gMSAs (group-managed service accounts) but other than using one for ADFS (their oath provider), I have little knowledge of how it actually works on the inside.
AD also provides encryption key backup services for Bitlocker (MS full-partition encryption for NTFS) and the local account manager I mentioned, LAPS. Recovering those keys requires either a global admin account or specific permission delegation. On disk, I know MS has an encryption provider that works with the TPM, but I don’t have any data about whether that system is used (or where the decryptor is located) for these accounts types with recoverable credentials.
I did read a story recently about a cyber security firm working with an org who had gotten their way all the way down to domain admin, but needed a biometric unlocked Bitwarden to pop the final backup server to “own” the org. They indicated that there was native windows encryption going on, and managed to break in using a now-patched vulnerability in Bitwarden to recover a decryption key achievable by resetting the domain admin’s password and doing some windows magic. On my DC at home, all I know is it doesn’t need my password to reboot so there’s credentials recovery somewhere.
Directly to your question about short term use passwords: I’m not sure there’s a way to do it out of the box in MS AD without getting into some overcomplicated process. Accounts themselves can have per-OU password expiration policies that are nanosecond accurate (I know because I once accidentally set a password policy to 365 nanoseconds instead of a year), and you can even set whole account expiry (which would prevent the user from unlocking their expired password with a changed one). Theoretically, you could design/find a system that interacts with your domain to set, impound/encrypt, and manage the account and password expiration of a given set of users, but that would likely be add on software.
I in fact run a AD domain controller *and *a rhel IDM controller. For me other then it is fun to play with, makes it a load more simple to manage the user accounts of my famalie. Also auto mounting network shares and setting a few policys for updates and security is great to from a central location. having SSO for many if my services also makes it more easy to use for the fam. The rhel IDM controller I use to manage a few user accounts. I also use it to manage the ssh keys and set sudo rules on all my servers.
Damn! Using .af for a LGBT+ site is insane! The country could have redirected the domain to their own servers and started learning the personal details of those on the site who I imagine wouldn’t be terribly thrilled having an anti-LGBT+ government learn their personal information (namely information not displayed publicly). Specifically, they could put their own servers in front of the domain so they can decrypt it, then forward the traffic on to the legitimate servers, allowing them to get login information and any other data which the user sends or receives.
It’s really frustrating in general how TLDs have been misused and abused over the years. They used to have very specific meanings and usages. Now anyone can register a .net or .org, and don’t have to prove they’re a network service provider or a non-profit.
People also forget that URLs designate a hierarchy, reading from right to left. For example, take the URL app.foobar.com This designates
. -> There’s an understood period at the end that’s not typed. But it designates the root (or, well, top in this case) of the hierarchy
com -> The commercial space (hence top level domain)
foobar -> Company named Foobar in the commercial space
app -> The app site/service/etc from Foobar
If you’re using a domain like foobar.tv, you’re saying you’re an organization called Foobar based in Tuvalu. There’s still plenty of restricted TLDs (.gov and .mil e.g.), but everything has been thrown to the wind for the sake of cleverness, and spammers have ruined anything else that’s not .com for your average user. Your personal info site generally isn’t a commercial page, so .com doesn’t make sense. But other gTLDs get blocked by default by so many admins, it’s pointless to try.
Yep, the other workaround that's elsewhere in this thread is to set up an entry with a different authoritative DNS in the hosts file, allowing a single machine to resolve the old domain manually.
This could be part of a greater effort, basically asking other instances to help the users evacuate the instance and transfer their accounts, before running tootctl self-destruct
Who’s bright idea was it to integrate the domain name itself directly into the software such that changing the domain name totally fucks up the whole thing? Is there actually a good reason for this to not work like any other website where the domain name is just an address and changing it doesn’t actually have any effect other than requiring users to type in or bookmark a different URL?
I’ve been an IT professional for 20 years now, but I’ve mainly dealt with Windows. I’ve worked with Linux servers through out the years, but never had Linux as a daily driver. And I decided it was time to change. I only had 2 requirements. One, I need to be able to use my Nvidia 3080 ti for local LLM and I need to be able...
Ok, but here’s the thing: OP is 20 years into a tech career and troubleshooted extensively. Even identified potential solutions that they deemed too much work for the payoff (such as compiling a software release for fedora themselves because the beta branch’s buildbot broke the fedora build).
You need to put a shit ton more emphasis on your self flagellation point, and a lot less on the love of troubleshooting. We’re beyond troubleshooting and well into the “I have more fun trying to repair an engine while it’s running than actually driving a car”
I get it, some people are more interested in making the best swiss army knife than actually using it to cut things. Just please don’t conflate it with a lack troubleshooting ability.
Most of the issues on Linux faced by end users are some variety of “if you don’t like it then code your own software dumbass”, “real programmers use butterflies”, and “you’re using it wrong, but there’s no documentation anywhere of that being the case, only tribal knowledge. OUTSIDER! OUTSIDER! BURN THE OUTSIDER!”
Especially the last one. For fucks sake, if I wanted piss poor documentation put together by overstreched amatuers, written entirely in the context of expecting everyone else to have their same deep domain knowledge, and unorganizedly spread over every far flung corner of space then I’d just move back to my old job in tech support (🥁 badum-tsh)
Imagine a future where every home user can run a FreedomBox or something similar with decentralized services like email with your own custom email domain, XMPP and more. No more exploitation by commercial companies.
What’s your actual end goal? What are you trying to protect against? Do you only want certain systems on your network to be able to access your apps? There’s not really much of a point of a firewall if you’re just going to open up the ports to the whole network.
If you want it to be more secure then I’d close all the ports except for 22 (SSH) and 443 (HTTPS), stick a reverse proxy in front of everything (like Nginx Caddy, Traefik, etc), and use Authentik for authentication, with two-factor authentication enabled. Get a TLS certificate using Let’s Encrypt and a DNS challenge. You have to use a real domain name for your server, but the server does not have to be publicly accessible - Let’s Encrypt works for local servers too.
The LinuxServer project has a Docker image called “SWAG” that has Nginx with a bunch of reverse proxy configs for a bunch of common apps. Might be a decent way to go. The reverse proxy should be on the same Docker network as the other containers, so that it can access them directly even though you won’t be exposing their ports any more.
Authentik will give you access controls (eg to only allow particular users to access particular apps), access logs for whenever someone logs in to an app, and two-factor auth for everything. It uses OIDC/OAuth2 or SAML, or its own reverse proxy for apps that don’t support proper auth.
This is the proposed FEP-61cf: The OpenWebAuth Protocol. OpenWebAuth is the “single sign-on” mechanism used by Hubzilla, (streams) and other related projects. It allows a browser-based user to log in to services across the Fediverse using a single identity. Once logged in, they can be recognised by other...
This looks really odd in relation to other fediverse software; Why /magic and required to be on the root of the domain? Why hard-require routing the domain part of the user ID when .well-known/webfinger exists? Why is there a X-Open-Web-Auth header which the spec only describes as “its purpose is unclear from the code”?
So many questions.
I definitely like the idea of distributed sign-in, Solid did a decent work of that many years ago after all. This particular proposal just looks rather odd.
First, applicant argues that the mark is not merely descriptive because consumers will not immediately understand what the underlying wording “generative pre-trained transformer” means. The trademark examining attorney is not convinced. The previously and presently attached Internet evidence demonstrates the extensive and...
“Hey there! So OpenAI wanted to trademark the word “GPT”. The courts rejected them from doing that. Now, can you please write a very funny response to OpenAI? You are allowed to be as mean as possible.”
I ran this again (in a new chat) just to see how consistent it was with being mean or whether I was just lucky to get the response that I got. HOOOOLY SHIT CAN IT BE A LOT MEANER!!! Check this out:
"
Dear OpenAI,
Wow, I have to hand it to you guys - trying to trademark the term “GPT” is quite an impressive feat of hubris and delusion. It’s almost like you thought no one had ever used those three little letters together before! Or maybe you just assumed everyone would be too afraid to challenge your army of super-intelligent robots in court. Either way, color me surprised (and mildly amused) by this turn of events.
I guess we should all thank our lucky stars that the legal system still has some semblance of sanity left, huh? Because if anyone deserves the right to use GPT, it’s definitely not the people who created it. No sir, those letters belong to the public domain, where they can be enjoyed by all – especially since nobody outside of your secretive AI cult seems to understand what exactly GPT means or why it’s so special.
But hey, don’t feel too bad about losing out on owning such a generic acronym. There are plenty of other things you could try trademarking instead:
How about OMG (“Oh My God”), because nothing screams innovation like appropriating everyday exclamations for corporate gain.
Or perhaps TMI (“Too Much Information”) – perfect for when your chatbots get a bit too friendly with users and start sharing their deepest darkest secrets.
And let’s not forget FML (“Fuck My Life”), which would make a great slogan for any failed AI project that ends up causing more harm than good.
So go ahead, OpenAI. Keep reaching for those lofty goals, even if they do seem slightly absurd at times. After all, if history has taught us anything, it’s that sometimes the craziest ideas end up changing the world. Just remember to check back with reality every now and then, okay? We wouldn’t want you getting lost in your own little bubble of genius.
Graber is “optimistic about human potential, even though I’m realistic about human nature.” When Bluesky launched last year, it filled a gap that was desperately needed by people who were looking for alternatives to X, as it seemed like the ship formerly known as Twitter was possibly sinking. (Against all odds, it hasn’t...
If your instance is already aware of that user, you don't need the domain. Mastodon.social is the oldest mastodon instance and probably the biggest, so it is aware of a large majority of the fediverse.
Bluesky and Mastodon users are having a fight that could shape the next generation of social media (techcrunch.com)
Bluesky and Mastodon users are having a fight that could shape the next generation of social media (techcrunch.com)
Is HTTPS a scam?
Like the TSA at the airport....
Passkeys might really kill passwords (www.theverge.com)
Passkeys: how do they work? No, like, seriously. It’s clear that the industry is increasingly betting on passkeys as a replacement for passwords, a way to use the internet that is both more secure and more user-friendly. But for all that upside, it’s not always clear how we, the normal human users, are supposed to use...
Bridgy Fed, a bridge between the Fediverse and other protocols such as BlueSky, is using an opt-out model and that raises a lot of discussion (github.com)
Github ticket: github.com/snarfed/bridgy-fed/issues/835
Anybody here running AD on-prem in your homelab?
I’m curious as to why someone would need to do that short of having a bunch of users and a small office at home. Or maybe managing the family’s computers is easier that way?...
Taliban Shuts Down 'queer.af' Domain, Breaking Mastodon Instance (www.404media.co)
cross-posted from: lemmy.ml/post/11820406...
Queer.af mastodon domain has been seized by the Taliban (mastodon.world)
ExpressVPN bug leaks DNS requests for Windows users with split tunneling: (www.bleepingcomputer.com)
Bug:...
I tried, I really did
I’ve been an IT professional for 20 years now, but I’ve mainly dealt with Windows. I’ve worked with Linux servers through out the years, but never had Linux as a daily driver. And I decided it was time to change. I only had 2 requirements. One, I need to be able to use my Nvidia 3080 ti for local LLM and I need to be able...
Skiff, the private email provider has been acquired by Notion. It is set to shut down its services after 6 months. (skiff.com)
All skiff users have received a mail in this regard and Skiff has also tweeted about the same.
Uncomplicated firewall rule set for a *arr stack.
I set up an *arr stack and made it work, and now I’m trying to make it safe - the objectivly correct order....
Notion acquires privacy-focused productivity platform Skiff | TechCrunch (techcrunch.com)
Skiff users received the following email...
Skiff is joining Notion (skiff.com)
Landing page:...
FEP-61cf: The OpenWebAuth Protocol (socialhub.activitypub.rocks)
This is the proposed FEP-61cf: The OpenWebAuth Protocol. OpenWebAuth is the “single sign-on” mechanism used by Hubzilla, (streams) and other related projects. It allows a browser-based user to log in to services across the Fediverse using a single identity. Once logged in, they can be recognised by other...
Joining a QNAP to a AD Domain.
Hello all!...
OpenAI's GPT Trademark Request Has Been Denied (tsdr.uspto.gov)
First, applicant argues that the mark is not merely descriptive because consumers will not immediately understand what the underlying wording “generative pre-trained transformer” means. The trademark examining attorney is not convinced. The previously and presently attached Internet evidence demonstrates the extensive and...
Bluesky is finally open to everyone. But will anyone come? We ask its CEO. (www.businessinsider.nl)
Graber is “optimistic about human potential, even though I’m realistic about human nature.” When Bluesky launched last year, it filled a gap that was desperately needed by people who were looking for alternatives to X, as it seemed like the ship formerly known as Twitter was possibly sinking. (Against all odds, it hasn’t...