I recall how a few of us who highlighted this risk (as well as the cost increase risk) back in the early 2010s when UofT was starting to migrate from on-prem (sovereign in newspeak) services to Microslop’s cloud. We were called crazy paranoid, etc.
Shared Services Canada (SSC) renewed its agreement with Microsoft Canada to procure software and services for the Government of Canada. In addition to the services renewed under this agreement, SSC will now be able to provide all public servants with access to Office 365, thus laying the groundwork for a digitally-enabled public service.
That’s awesome. If I had to guess, the data of the Teams call might not leave Canada but it might be stored temporarily in a Canadian Azure dc where it’s STT-ed, transcript analyzed and matched to whoever’s bid to be called up. The bidder could be an American firm and the call to it isn’t the Teams data so “no foul” been committed. 🤭
E: some might call this industrial espionage.
S0ix is fine. LTT doesn’t know shit about shit. I use it on first gen Framework. It works way more reliably than S3 since there’s little nees for special handling in drivers and firmware. The Framework already consumes 3W when idle. S0ix brings that down to 1-2W. The first gen suppprts S3 and that doesn’t consume less power. So either way I need suspend-then-hibernate or suspend-to-both and that’s what you want as well. You’d have to forgo Secure Boot to enable hibernate. If root is on Ext4 on encrypted LVM, hibernate works even with a swapfile (default on modern Ubuntu). For fancier setups like root on ZFS you’d need to use encrypred swap partition for it. That’s what I currently use. If you want to know more details, have Qs, ask away.
This is true but it’s nice to have the whole app, data and database in one place, going together, snapshotted together, “backupable” together. It’s slower for sure. That said it can be reasonably fast with a large pool (more disks). With the magic of SSD cache, database reads fly and reads are the majority of the loads in my heads. In the future I would put root on ZFS as well and either do SSD cache or have root on ZFS SSD pool that gets send/recved regularly onto the spinning pool so it’s easy to restore when needed.
Right? Windows gives MS enormous market power beyond the desktop license revenue. At the same time there’s obvious cost savings to be had by outsourcing the OS. What is the capitalist to do facing this conradiction… 🤭
Thanks for the pointer. Checked, tried a couple others - they don’t know about it. They have some other non-random DNS records. AFAIK they can absolutely find it if they scan for all domains, but it’ll take forever if the name is randomly-generated and sufficiently long. Someone has to be determined to spend the resources. This doesn’t guard against that but against bots trying to fuck with the service at the port. I could move it to a wildcard though. There’s an overlap with another subdomain (they’re actually sub-subdomains and the first sub is common) but I could move that.
Hm. As far as I know that can only be done if AXFR is enabled (it’s not), if the domain has entered some search engine that has remembered it, through SSL cert that’s not wildcard, or through brute force lookup. Am I missing something?
It’s just an A record pointing to my IP. IP’s updated from my router via the DNS provider API.
Thanks for looking into it. As far as I read they moved to an ORM with 10.11 as a prereq to supporting other db engines. I’m guessing the db connection code would be undergoing major changes when they do that so I wouldn’t rewrite the current implementation. I’d either follow that work and help them get it right or rework the implementation after they’re done. We’ll just suffer through the mean time. 😄
64K is generally small recordsize. For media they recommend 1M. My db was sitting on the default 128K recordsize and perforned fine on 10.10. It doesn’t matter much for reads because ZFS keeps it in RAM and if it gets evicted it goes into SSD cache (l2arc). But for writes the cache wouldn’t help unless I disable sync which risks data loss. I don’t think 10.10 did much writes during lib scan so write perf only mattered when something changed.
Not sure if this is the problem I was hitting with my Home Videos library type. It’s got directories with YouTube videos. I tried re-adding it in 12-rc3, which was released a month after the nightly mentioned in the issue thread. Still couldn’t complete. I ended up re-adding the media as Shows library. Works okay with the directory structure I have.
That would be reasonable. I did repeated rescans and only counted subsequent rescans. For me the initial scan after upgrade took a bit more but not hours. Subsequent scans took less. E.g. 20min -> 13min for write-optimized filesystem. So that’s reasonable, although 10.10 was way faster. Library scans are expected to get faster in 13 according to some Github threads I read.
When I had the broken Home Videos library I waited 3 days for the initial scan to complete and it did not. Repeated rescans did not seem to complete although I didn’t wait 3 days for them. I’m not taking into account those scan times. Something was wrong with this library type on 10.11 and/or my media. Worked fine on 10.10.
Do you mean the SSL cert? Yes, that’s wildcard on *.mydomain.com. Then the subdomain is kvtn4ftxfreurdcw7qtr21mcywxaqqm.mydomain.com.
I came up with a funny strategy I use to lock it down a bit. What’s exposed to the internet for me is Apache2 reverse proxy. The proxy is locked down to reject all connections EXCEPT for the ones coming from a special subdomain which is something like a 64-character long random string. This prevents pretty any unwanted connections. Obviously the special subdomain must remain as secret as a shared password among the Jellyfin users. It works for trusted users.
What I want ideally is an “authenticated firewall.” OpenWrt rejecting all connections on the open port except for an allowlist of IPs. Then there must be a system where users can authenticate and their IP is added to the allowlist. I haven’t found an off-the-shelf solution like this but I’ll make it some day. Too bad I figured this random string subdomain trick cause it seems good enough for now. :D
600MB. Would that require changes to Jellyfin? They’re on the path to introducing Postgres support.
Complications, yes!
With great power come great … uuh … :D
Also the meme is just bait so you read abt the problem and see if you need to solve it for your setup.
Good to know. I will make sure not to update as mine isn’t doing it yet.