chameleon

Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can’t have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine’s announcement for better info.

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

That looks correct to me if uid 1101 == userC. Sorry, don’t really know what it might be then.

Complete shot in the dark, but I would start by comparing podman system info between the two user accounts, with the most importance on the idMappings. Podman is usually configured to use rootless by default, and this can result in wildly different behavior based on whether /etc/subuid and /etc/subgid are configured to give your user IDs or not. See tutorial if your user 1001 is missing.

Modern distro installers tend to give the user created during setup 65536 IDs, but useradd usually doesn’t do that by default. This is really distro-specific stuff though and I don’t know how modern Fedora handles it, so I might be grasping at nothing here.

Can’t wait for a new generation to rediscover the exciting fun of having to survive Kil’Jaeden’s balls and whatever that darkness phase is even supposed to be, despite the boss technically hitting 1 HP in 5 seconds.

Steam changed it so that popularity metrics are mostly ignored during the first couple days of Next Fest. This started with the October 2024 run, and it’s a big part of why you no longer have the good demos popping up quickly at the start. To my knowledge, they never published details on it, but there was a short blurb in the developer Q&A. Things should get better starting sometime tomorrow (tends to be day 3 or day 4).

The idea is that it gives games that don’t have pre-existing marketing a way better chance of success, instead of the really massive snowball effect that used to exist where devs lost out for the entire thing if they weren’t popular within the first couple of hours, but it has made it a hell of a job to look for new games.

All true, wanted to add on to this:

Note that smart peeps say that the docker socket is not safe as read-only.

That’s true, and it’s not just something mildly imperfect, read-only straight up does nothing. For connecting to a socket, Linux ignores read-only mount state and only checks write permission on the socket itself. Read-only would only make it impossible to make a new socket there. Once you do have a connection, that connection can write anything it wants to it. Traefik and other “read-only” uses still have to send GET queries for the data they need, so that’s happening for legitimate use cases too.

If you really need a “GET-only” Docker socket, it has to be done with some other kind of mechanism, and frankly the options aren’t very good. Docker has authorization plugins that seem like too much of a headache to set up, and proxies don’t seem very good to me either.

Or TLDR: :ro or stripping off permission bits doesn’t do anything aside from potentially break all uses for the socket. If it can connect at all, it’s root-equivalent or has all privileges of your rootless user, unless you took other steps. That might or might not be a massive problem for your setup, but it is something you should know when doing it.

They’ve been flagging physical carts showing up in multiple places at the same time since the very moment the first Switch flashcart appeared (so likely before we ever had our hands on any). Places discussing the flashcart had been talking about increased detection and bans for a year or so.

It was even done on the 3DS before that. The 3DS had a whole tiny niche ecosystem of people selling “private headers”, dumping only the unique per cartridge info and selling it with the promise that they’d only sell any given header to one person. That too had a few instances of normal people complaining about bans with pre-owned games.

There’s a disclaimer in the readme: https://github.com/juanfont/headscale/?tab=readme-ov-file#disclaimer

The maintainer Tailscale contributes happens to be the lead developer by commit count at the moment.

They also had a major ass security issue that a security company should not be able to get away with the other day: assuming everyone with access to an email domain trusts each other unless it’s a known-to-them freemail address. And it was by design “to reduce friction”.

I don’t think a security company where an intentional decision like that can pass through design, development and review can make security products that are fit for purpose. This extends to their published client tooling as used by Headscale, and to some extent the Headscale maintainer hours contributed by Tailscale (which are significant and probably also the first thing to go if the company falls down the usual IPO enshittification).

Not them but between those two I’d recommend Kanboard if you’re going to be the only user. Far lighter and easier to administer piece of kit, has everything you’d want from a fancy task list but not much more. WeKan is rather heavy software but does have a few features that are probably quite important for large team use.

PUID is indeed handled inside the container itself, it’ll run a container-provided script as whatever the container’s UID 0 happens to be first which then drops to whatever $PUID happens to be inside the container. user= is enforced by Podman itself before the container starts, but Podman will still run as root in that setup. That means Podman is running “rootful”, while if you started the container manually as $uid using the regular Podman CLI, it would be “rootless”. That is a major difference in a lot of respects, including security, and you can find quite a bit of documentation on the differences between those operating modes online; it wouldn’t fit in a comment. Rootless is generally considered the better mode, though there are some things that still require a rootful container.

In the upcoming NixOS 25.05 or current unstable, there are some tools you can use to run containers rootless as another user more easily using a new $name.podman.user = ""; setting. From what I understand they’ll still be root-managed systemd system services that require sudo to operate, but that means privileges get dropped by systemd before running Podman, instead of dropped by Podman before running the container. This stuff is recent and I haven’t used it, I just happen to know it exists, relevant nixpkgs commit if you wanna dig into it yourself: https://github.com/NixOS/nixpkgs/commit/7d443d378b07ad55686e9ba68faf16802c030025

FWIW, your domain will most likely eventually get used by spammers and then it’ll be an endless string of somewhat expected but unpredictable failures from there on onwards, with no actions you can take to reduce it. It’s good to keep an eye on what comes in but I wouldn’t invest too much effort into failure alerting.

That’s what I’ve been trying, yesterday ended up being a little more fruitful (internet complaining trick worked!) and luckily gave me more interesting rooms, though I’m not convinced it was any action on my part that did it.

Started Blue Prince, but to be honest I haven’t gotten past the initial “RNG wall” and I’m sorta over it. I’m 5 hours in and continue to get the same rooms I’ve documented in detail in my notes with little new to show for it, and while I have some leads and puzzle pieces, nothing fits. Not particularly excited about a lot of the small repeat puzzles anymore either. I get the impression that I just need one or two pieces of knowledge that the game is refusing to provide to me. Kinda hoping that the good old trick of complaining on the internet will make things work out.

It was just a two question + your name form: type-in your #1 pick but also why. Full-on first past the post, single vote only, no option to name other games. Pretty flawed methodology overall.

That said, I will admit that I did put in Shenmue and while I didn’t expect it to get #1, I hoped it’d be top 3 at the very least. I really do trace more or less every successful strongly story based open world game of the 2000s back to a combination of Shenmue and Half-Life. Shenmue’s story didn’t have a super wide appeal and would be completely uninteresting to most teenagers at the time (which was still the main gaming audience), but the method of storytelling is top-notch, and its open world just felt far more genuine than anything predating it. Meanwhile, Half-Life did an excellent job at telling a story that looks boring but is actually very interesting, and did so in an engaging, if not particularly open world way.

Borg or the like with ‘hardcoded’ plaintext/regularly full-disk-encrypted key is acceptable. Someone that has your unencrypted private key sitting on your server has almost certainly already obtained access to the entire set of data you’re backing up, with the backup key itself only meaningfully guarding access to older backups.

The more important thing is to securely keep extra copies in case the server fails. I keep mine in a group in my password manager, one per repo.

Powered through Beastieball over the past week, a creature collector/“sports” game from the devs of Chicory and Wandersong. I had fairly high expectations because I enjoyed the devs previous work, but it turned out even better than expected. Lots of cool creature designs, music is Lena Raine’s usual standout stuff, story kept my attention.

The sportsball system is surprisingly complex, if a little hard to learn. I went through multiple types of team setup and felt like a lot of different setups were viable in the end. Every match is a 2v2, every offensive turn is 3 actions worth, and you get a defensive turn too. You really have to build a team with good synergy between them and be smart about swapping in and out.

Only real downside is it’s still early access and a decent chunk of creatures have placeholder art or don’t have the full set of animation frames yet. Most are reasonably finished but there’s a couple that are a little jarring.

I don’t have Obsidian around, but this has been happening elsewhere lately too, almost certainly because of this underlying Electron issue: https://github.com/electron/electron/issues/43819

Unfortunately there’s not much you can do about it. Electron decided to depend on functionality not yet in a released version, and that very interesting choice flows down to everything that updates their Electron on the regular.

Sorry, I’ve had a (self-imposed) busy week, but I have to admit, that also has me rather stumped. As far as I can tell, your second entry should work. If the device is visible in /dev/mapper under a name, it should be able to mount under that name.

The only thing I can think of is that some important module like the ext4 module might be missing somehow? You can get pretty confusing errors when that happens. Dracut is supposed to parse /etc/fstab for everything needed to boot, and maybe that’s not recognizing your root for some reason. dmesg might have some useful info at the end after you try to mount it. If that’s what’s happening, you could try to add add_drivers+=" ext4 " in your dracut.conf and regenerate it (the spaces are important!). But if that’s not it, then I’m probably out of ideas now.

I think you should check your root= line and add a rd.luks.uuid= to make it open it. Dracut will by default open the root FS as /dev/mapper/luks-abcdef... based on the LUKS container UUID. You can get that with cryptsetup luksUUID. /dev/mapper/root is just never going to show up unless you’ve assigned a custom name to that with the barely documented rd.luks.name, and I don’t see that in your setup. The cryptroot and cryptdm parameters aren’t used by Dracut either.

With all of that missing it’s just gonna wait for that /dev/mapper/root to magically show up out of nowhere, without ever trying to open it.

A correct cmdline will probably look something along the lines of root=/dev/mapper/luks-<uuid> modules=sd-mod,usb-storage,ext4 rootfstype=ext4 rootflags=rw,relatime rd.luks.uuid=<uuid> and once opening with passphrase works, you can start to mess with rd.luks.key=/awesome.key (and readd quiet when done debugging, if you want it that way).

ldconfig errors and the missing modules should be fine. musl’s ldconfig is just a bit different but also isn’t required in quite the same way. I don’t think you should need to mess with modules manually. I don’t think you’re using LVM’s userland for your setup, just all the device-mapper kernel modules. Dracut will pull all the necessary bits in for you if you’re setting it up for LUKS.