You can defenetly have that area patched from the inside.

Pretty much all my jeans are patched there (biking tears through pants) and you barely notice.

aansprakelijkheidsverzekering in Dutch

You have to be kidding, right?

Super fair, ich habe erst die letzten Jahre angefangen mich mehr mit Containern auseinander zu setzen und da war diese Gefahr in vielen Tutorials recht präsent. ist wahrscheinlich ein shift der da in der Wahrnehung zwischenzeitlich passiert ist.

I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago. (Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)

Also, this is documented:

Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.

First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.

https://docs.docker.com/engine/security/#docker-daemon-attack-surface

You wouldn’t download a plagarism machine!

The way I read it, it is fine if you do not allow password authentication in general?

This also gives you the option to give more helpfull pasword hints like “we believe your housband might have the same password as you, just ask him”.

Wait, your screensaver has ads?

Another issue also is differentiating between hidden requirenments, undocumented features (positive), bugs (negative) and developer choice made during coding of the legacy software which does not affect the program positively or negatively.

A LLM (or alternatively a tem of developers) could do a reasonable well job of repuducing all these features and behaviors in a new program. But at that point you have effectively just cross-compiled your code (and maybe refactored it a bit).

The real issue is in identifying essential and wanted features from all the features, even if you could magically extract all of them. And in most cases that requires a deep understanding of the target audience/customer, which I would argue no person (including the customer), let alone a LLM, just has without years of requirenment refinement.

Just out of curiosit, what do you gain from unmounting the fs? Depending on your reasoning, it might he an option to use a zfs filesystem, set it up so automatic jobs rarely run and then set a somewhat agressive disk spin down policy. That way fs info would be handled by the arc, not the disks and they would only spin up when an actual file is accessed.

At least I assume it would work this way. Look-Ahead reads or your explorer generating previews, etc. might well make thta option fail.

I had an issue setting up immich for my parents, whre the fs would stall too long for it to successfully get files. Missing media was just getting displayed as a grey box with a “missing media” text on them.

Could not find a less jpg version :/

Just mentioning the words “fertility monitor” in the post (or these comments) would probably have helped. I (and I assume those who downvoted) have never heared of the brand names in the article and do not even know what broad category of devices you were talking about.

For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).

But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities when a fix exists.

Portions that small will only be available for an additional tiny convenience fee of $2. Sorry.

I think (modern) rat poison works by mimicking vitamin K thus inhibiting digestion of actual vitamin K. This in turn will lead to internal bleeding and therefore the rats death. So if you eat enough of it or are small (like children) and decide not to seek a doctor to stop the symtoms it can defenetly kill you, albeit slowly and painfully.

You could however save money, since this kind of rat poison is not really biodegradable and sticks around in its victims and their predators. So just eating a dead rat would be cheaper and might have the same effect.

Why is it just exposed like that. That seems needlessly dangerous.

I have an HDD at my parents place and manually bring over snapshots when I visit. Off site does not necessarily mean cloud.

Donkey

If you are using aptitude (apt) it is quite simple: https://ubuntu.com/server/docs/how-to/software/automatic-updates/

If you just want security updates and are fine with the default configs:

# apt install unattended-upgrades