- oauth, and control sign ups via there. Don't let people sign up via forgejo itself.
- anubis, yeah. Or similar.
- forgejo actions is an optional component... and forgejo users can bring their own actions server. Of course, it's a risk to them since the server owner could execute code in actions. But yeah.
moonpiedumplings
Nuitka is interesting. The articlenotes that it compiles python to bytecode, instead of bundling an interpreter, which is true.
But what the article doesn't mention is that Nuitka has a paid version, which includes a feature of code/binary obfuscation, in order to make reverse engineering more difficult. I wonder if hackers used the paid version?
Void auth, or kanidm look like easier alternatives.
I have installed an OS onto just the btrfs root subvolume, leaving the home directory intact. This is how I originally swapped from Manjaro to Arch. The arch manual install instructions helped.
But this should be a feature of the graphical installers imo.
Transparent fileystem compression and deduplication (btrfs feature not in ext4) compresses data while still having it be accessible normally. This leads to big space savings.
You can use the tool compsize to check it out.
Postgres jsonb?
That's what I thought too: https://programming.dev/comment/22854391
But it seems to be possible to still do them wrong.
Flatpak sandboxing uses bubblewrap, which uses seccomp and can filter syscalls.
LXD/Incus can run qemu-kvm virtual machines in addition to containers. In fact, I like the security posture of LXD/Incus better here because they use cgroups, namespaces, seccomp, to sandbox the qemu process, which libvirt also does but proxmox does not.
I like ORM's because they prevent sql injection. Mostly. Sql injection is a really bad vuln that's nowhere near as ubiqitous as it used to be for every php app, and that's partly due to ORM's.
It's all about control. They demand control over servers, not allowing you to self host. They also demand control over communities, by putting them all in one big server or other controlled channels (but sometimes refusing to properly moderate them like in league of legends).
Now, they want to control your device.
Sometimes I wonder if Vanguard is actually a government pet project for practice blocking and executing malicious pci devices.
You take one of those pci dma cheat cards, put a modem in them, and you've broken secure boot. And nation states have done such a thing to compromise laptops or other devices after getting physical access to them for a bit.
