• 1 Post
  • 44 Comments
Joined 1 year ago
cake
Cake day: August 10th, 2023

help-circle






  • Because forgejo’s ssh isn’t for a normal ssh service, but rather so that users can access git over ssh.

    Now technically, a bastion should work, but it’s not really what people want when they are trying to set up git over ssh. Since git/ssh is a service, rather than an administrative tool, why shouldn’t it be configured within the other tools used for exposes services? (Reverse proxy/caddy).

    And in addition to that, people most probably want git/ssh to be available publicly, which a bastion host doesn’t do.







  • sn1per is not open source, according to the OSI’s definition

    The license for sn1per can be found here: https://github.com/1N3/Sn1per/blob/master/LICENSE.md

    It’s more a EULA than an actual license. It prohibits a lot of stuff, and is basically source-available.

    You agree not to create any product or service from any par of the Code from this Project, paid or free

    There is also:

    Sn1perSecurity LLC reserves the right to change the licensing terms at any time, without advance notice. Sn1perSecurity LLC reserves the right to terminate your license at any time.

    So yeah. I decided to test it out anyways… but what I see… is not promising.

    FROM docker.io/blackarchlinux/blackarch:latest
    
    # Upgrade system
    RUN pacman -Syu --noconfirm
    
    # Install sn1per from official repository
    RUN pacman -Sy sn1per --noconfirm
    
    CMD ["sn1per"]
    

    The two pacman commands are redundant. You only need to run pacman -Syu sn1per --noconfirm once. This also goes against docker best practice, as it creates two layers where only one would be necessary. In addition to that, best practice also includes deleting cache files, which isn’t done here. The final docker image is probably significantly larger than it needs to be.

    Their kali image has similar issues:

    RUN set -x \
            && apt -yqq update \
            && apt -yqq full-upgrade \
            && apt clean
    RUN apt install --yes metasploit-framework
    

    https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

    It’s still building right now. I might edit this post with more info if it’s worth it. I really just want a command-line vulnerability scanner, and sn1per seems to offer that with greenbone/openvas as a backend.

    I could modify the dockerfiles with something better, but I don’t know if I’m legally allowed to do so outside of their repo, and I don’t feel comfortable contributing to a repo that’s not FOSS.







  • No, it is lock in. If apple allowed for multiple app stores other than their own, then users could pay for an app on one app store, and then not have to pay again on another, potentially even on non-apple devices.

    I encountered this when I first purchased minecraft bedrock edition on the amazon kindle. Rather than repurchasing it on the google play store when on a non-amazon, I simply tracked down the Amazon app store for non-amazon devices, and redownloaded it from there. No lock in to Amazon or other android devices, both ways.

    Now, the Apple app store would still probably not work on androids… but now they would actually have to compete for users on the app store, by offering something potentially better than transferable purchases across ecosystems.

    I suspect the upcoming Epic store for iOS and android may be like that… pay for a game/app on one OS, get it available for all platforms where you have the Epic store. But the only reason the Epic store is even coming to iOS is because Apple has been forced to open up their ecosystem.