mgbmtl

You may enjoy :

- End Times Fascism, And the Fight for the Living World (Naomi Klein and Astra Taylor)

- The Age of Extraction: How Tech Platforms Conquered the Economy and Threaten Our Future Prosperity (Tim Wu)

Most of the forums I participated in, in the past, ended up dying because of a very persistent troll or two. Some of them I knew in person. They were just so arrogant and thought they were doing the right thing. The communities died. A healthy community gives everyone the chance to speak. In person, that's often done subtly by moderators.

I run scripts on my servers on an hourly basis to check which are the top 25 IPs visiting the server (aggregated by /24). If anyone in those top 25 IPs are from China, Vietnam, etc, or from Alibaba/Amazon/etc, the /24 gets blocked by iptables.

It's far from perfect, but it was a quick way to get rid of bots, while not completely blocking people from countries such as Vietnam.

However, on a Gitlab instance I manage (500 users), we have to restrict viewing of git logs and pretty much everything except issues. The bots were too aggressive. Chinese crawlers have access to a huge range of IPs and they often do only 10-20 requests per day, while generating in total over 50k requests per day. Our server load went from 99% down to 0.1% after that (and it's a fairly big server).

I have a really long passphrase in keepassxc. I often try to type it, fail 50% of the time, display the password, fix the typo. I would not use a long passphrase otherwise. (I understand there are other risks, such as having spyware that is recording my screen, but my main worry is for the safety of the file itself)

I know sudo-rs will likely not allow viewing the password in the short term, but the benefit to being able to have some visual feedback, is that it lets me use a more complex password.

Other example: if I'm on a ssh link with very high latency (ex: on a phone), I might type one character at the time, make sure they register correctly, and continue. If I can't do that, then I'll type the password in a text editor, then copy-paste it into the password prompt.

We have EU clients that now force us to use BBB (big blue button) for security reasons. It's not perfect, but good enough, and Zoom/Hangouts/Teams all have their quirks. We decided to adopt it where I work, and cut a few paid Zoom accounts.

Some clients use Jitsi, but I find it more complicated to run Jitsi in-house. BBB was really easy to setup.

Donations only get you so far. Take a mid-sized project, that needs $500k per year (a few devs, very modestly paid, zero expenses). It's a lot of money. It requires a huge user base. Say you have 500k users, and 5% donate $25 per year (I'm optimistic). And that's just $500k US, a few devs, zero expenses. A project that size probably has audit requirements, hosting costs, accounting, legal, trademarks, etc.

I see finances for a few free software projects, and many of them really struggle to get donations year after year, in a way that helps make the project predictable and sustainable.

For the US, people want you to be a 501c3, and then you need a EU equivalent. Canadians are unlikely to give to a US org (especially these days), but the market is too small to setup a local charity. So you need partners. All that has many compliance requirements and paperwork, so you need non-tech employees for the fundraising and accounting.

Eventually your big donors start blackmailing the project if you don't do what they want, and often their interests are not aligned with most users. You need various income sources.

I for one, am grateful to Mozilla for still being around, pushing for an open web.

Their documentation is excellent, the improvements and roadmap for Thunderbird made me finally adopt it, and I appreciate their privacy-friendlier translation services. uBO works great in Firefox, and I can't stand using a browser without its full features.

About MBA types: the free software project I work for has an MBA type, which I initially resented as being an outsider. However, they manage the finances, think about team and project growth long-term (with heavy financial consequences), and ignore the daily technical debates (which are left to the lead devs), and listen to users, big and small. Some loud users like to complain that we don't listen to them, and sometimes we kick them out, because we do listen to users.

I don't know much about Mozilla internals, if I am to judge from the results: Mozilla is still here, despite everyone saying for 10+ years that they are going to die. They are still competitive. They are still holding big tech accountable, despite having a fraction of their power. I can imagine that they make a lot of people here very uncomfortable.

The sync would stall and I'd have to go retry, or it would fail with no error clear message. In the end, I had no idea what had really synched correctly. The app was unhappy if I deleted a photo too quickly.

With Syncthing, I sync to a directory that my Nextcloud user can access (a read-only mount), so I can still easily share photos using Nextcloud, for example.

(although it's unfortunate that the Android syncthing app is being retired. h/t for the heads up and the recommended alternatives)

My device is not rooted, but I use Syncthing as well. I mainly sync my photos and my TOTP tokens (Aegis). The rest I don't care about.

I used Nextcloud sync in the past, but found it unreliable.

I'm all for competition, but smaller players would have been completely blocked by Privacy Shield, whereas they cannot block CloudFlare completely without breaking a lot of other sites.

And CloudFlare went to court. Most companies would not be able to afford it.

ICQ was a way of texting friends so that you could go party. At least for me, and I'm a nerd. I remember even "normal" friends were using IRC as a way to hookup. Cell phones were not very common.

Looking at my non-nerd 17 year old, they meet maybe once a month, and it's to cook food together during the day. Nobody drinks. They just see it as a waste of money. Maybe not the most normal sample. They love biking and also go to circus school together (Montreal).

I like icinga's model, which can run a small agent on the server, but it doesn't run as root. I grant specific sudo rules for checks that need elevated permissions.

I find it easier to write custom checks for things where I don't control the application. My custom checks often do API calls for the applications they monitor (using curl locally against their own API).

There are also lots of existing scripts I can re-use, either from the Icinga or from Nagios community, so that I don't write my own.

For example, recently I added systemd monitoring. There is a package for the check (monitoring-plugins-systemd). So I used Ansible to install everywhere, and then "apply" a conf to all my Debian servers. Helped me find a bunch of failing services or timers, which previously went un-noticed, including things like backups, where my backup monitoring said everything was OK, but the systemd service for borgmatic was running a "check" a found some corruption.

For logs I use promtail/loki. Also very much worth the investment. Useful to detect elevated error rates, and also for finding slow http queries (again, I don't fully control the code of applications I manage).