nottelling @ nottelling @lemmy.world

Posts

1

Comments

111

Joined

2 yr. ago

Not even close. Cuphead is a run & gun shooter, this is a Metroidvania. Cuphead is intentional hand drawn throwback art, this is Disney's current iteration of the mouse and friends art style.

The only similarity is that both use cartoon drawings.

You really don't need to be that paranoid for personal stuff. Use a cookie manager extension like NoCookie, NoScript, uBlock Origin, and isolate with Firefox Containers.

The idea of an "attack surface" from extensions is valid enough, but you can improve your overall security posture with more good extensions thanv trying to manually maintain everything yourself.

The Pi4 is a pretty impressive little machine. It'll probably host a few users, but from what I understand, it's the federation that really starts scaling the requirements.

Bigger problem with the Pi though is that it runs off an SDcard (by default), which have limited writes, and you'll burn that up fast.

There are no "the Lemmy servers", since there is no central "Lemmy" organization to host and run such servers.

So yeah, you can run it on whatever you can find that has available disk space, CPU cycles, and an Internet connection. Hosted VPS, colocated hardware server, raspberry pi, your gaming rig, AWS containers, whatever.

1. No. Your desktop password manager is encrypted with a strong passphrase that locks when you're computer locks. (Right?) They'd have to snatch your gear mid-session. Cookies are not safe, and cookie hijacks are a pretty common exploit. Cookies are for convenience, not security. Retaining authentication cookies is a very big security hole that we all do, and it's why banks don't let you re-auth on a previous session cookie.
2. "Pretty hard to break into" is the kind of phrase that keeps infosec people up at night. It's the kind of phrase that reads to me as "full of vulnerabilities so I can easily break in." You probably want to read up on your security practices.
3. Yes. First party cookies can be just as nefarious in addition to the technical requirements. Cookie managers are more relaxed about first party because we assume you're on that site for a reason, not because the cookies aren't a risk.

3a. Never assume that something supposed to be "mostly benign" isn't currently being exploited for bad reasons.

To your OP, It's actually not a terrible idea to uninstall the PW manager browser extension. It's one more layer of isolation from the browser. You just lose the convenience of autofill.

But definitely rely on the PW manager for session security and not cookies.

Edit: a couple edits.

I keep trying this, usually when I come across someone in my contacts who I haven't seen in a decade or something. Particularly after deleting Facebook a few years ago, I want to keep up with people.

It's always the same pattern though. We hang out, have a great time, sometimes do it one or two more times, and then it just never happens again. The problem is that it's always me doing the lifting. I have to remember to call, set up some plan, make the thing happen. If I don't do the work, it doesn't work.

I generally end up deciding that it's not worth my time to fight so hard to see someone who obviously isn't interested in prioritizing time with me.

One or two have maintained touch, but there's probably a dozen more who fell back off the map. Forever the optimist though, I've got another one on the calendar in a couple weeks.

Only one response in here for using Nginx, and there should be more. The Nginx SSL proxy works with the DuckDNS add-on to manage your IP address and and keep your LetsEncrypt certificates up to date.

If you own a domain and want to do that, you can use the Nginx Proxy Manager, which can also manage LetsEncrypt certs. It's a bit more complex to set up.

Combined with the OTP authentication built-into Home Assistant, it's a pretty good option. The risk is that Home Assistant itself is your edge, and it's always possible there's something to exploit on the front-end.