Super fair, ich habe erst die letzten Jahre angefangen mich mehr mit Containern auseinander zu setzen und da war diese Gefahr in vielen Tutorials recht präsent. ist wahrscheinlich ein shift der da in der Wahrnehung zwischenzeitlich passiert ist.

I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago. (Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)

Also, this is documented:

Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.

First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.

https://docs.docker.com/engine/security/#docker-daemon-attack-surface

You wouldn’t download a plagarism machine!

The way I read it, it is fine if you do not allow password authentication in general?

Another issue also is differentiating between hidden requirenments, undocumented features (positive), bugs (negative) and developer choice made during coding of the legacy software which does not affect the program positively or negatively.

A LLM (or alternatively a tem of developers) could do a reasonable well job of repuducing all these features and behaviors in a new program. But at that point you have effectively just cross-compiled your code (and maybe refactored it a bit).

The real issue is in identifying essential and wanted features from all the features, even if you could magically extract all of them. And in most cases that requires a deep understanding of the target audience/customer, which I would argue no person (including the customer), let alone a LLM, just has without years of requirenment refinement.

Just out of curiosit, what do you gain from unmounting the fs? Depending on your reasoning, it might he an option to use a zfs filesystem, set it up so automatic jobs rarely run and then set a somewhat agressive disk spin down policy. That way fs info would be handled by the arc, not the disks and they would only spin up when an actual file is accessed.

At least I assume it would work this way. Look-Ahead reads or your explorer generating previews, etc. might well make thta option fail.

I had an issue setting up immich for my parents, whre the fs would stall too long for it to successfully get files. Missing media was just getting displayed as a grey box with a “missing media” text on them.

You would think … https://www.entwicklungsstadt.de/berlin-hauptbahnhof-suedkreuz-rolltreppen-kaputt/

At the station it became apparent that a few of the escalators were working again by now. However, some entrypoints remained closed off.

And a few months later:

Just mentioning the words “fertility monitor” in the post (or these comments) would probably have helped. I (and I assume those who downvoted) have never heared of the brand names in the article and do not even know what broad category of devices you were talking about.

For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).

But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities when a fix exists.

Maybe for most personal users, but in B2B (where the money is) …

I have an HDD at my parents place and manually bring over snapshots when I visit. Off site does not necessarily mean cloud.

If you are using aptitude (apt) it is quite simple: https://ubuntu.com/server/docs/how-to/software/automatic-updates/

If you just want security updates and are fine with the default configs:

# apt install unattended-upgrades

Eh, for a toaster it at least makes some sense to have ‘smarts’ for ensuring various types of bread reach the desired crispynes (Lathough none of that needs internet or anything close to 400$ in value). So it would still be more usefull then smart fridge.

You can test that on this site:

https://no-sct.badssl.com/

I don’t know why you are being downvoted. You are right, Syncthing does not support local sync.

From the changelog:

Packaging

• Debian Bullseye and Ubuntu Focal packages are no longer built

Are you maybe running Focal?

Yes, especially once you have been informed about it

Does the issue only occour for live photos? If so it might also be an issue with video codecs 🤷‍♂️.

And of course encrypting the drive the files are on.