HTTPS is privacy in transit. It has no say into what’s being downloaded.

You’re right I don’t think it can, can only advertise explicit labels.

It’s not a fine standard. Microsoft filed it with the express goal of preventing ODF from becoming the prevailing document standard, not with the goal of documenting OOXML. It’s intentionally obfuscated and kept different from MS Office. It’s not a standard it’s a red herring.

Please note that to use “bcrypt” for htpasswd_encryption you need the bcrypt python module installed. Some distributions of radicale (eg. some docker images) don’t have it.

It’s fairly safe to set it to “md5” instead. It does not mean plain MD5 (one iteration), it does several hundred rounds of MD5 plus a salt.

For the curious, the advantage of bcrypt over a single-iteration, fast hash like MD5 is that bcrypt lets you set the hashing effort, while MD5’s goal is to do it as fast as possible.

This becomes relevant when someone steals your password file and tries to brute force it by hashing a bunch of dictionary words and random strings (plus a bunch of salts) until something matches. A fast single-iteration hash like MD5 will let them do that much faster than a bcrypt hash set to a higher effort; it can mean the difference between finding a password in one week vs finding one in 100 years. That’s what the hundreds-of-iterations MD5 is trying to achieve, it’s a “poor man’s bcrypt”.

The former.

Evil billionaires are more of a 2020’s thing.

The thing about Elder Scrolls games is that they tend to be mostly RPG while BotW is mainly a sandbox game with some RPG elements. Most people I’ve seen trying to get the “BotW feeling” from an RPG ended up dissapointed.

You can mod ES games extensively to make them feel more sandbox-ish, or simply ignore quest lines and freeroam but it’s not quite the same.

Civ 5 is 30€ on Steam and 2-3€ on other Stores.

Outer Wilds is 23€ on Steam and 16€ elsewhere.

There may be regional differences for either of us.

Euro-Office and OnlyOffice don’t “only support” OOXML. Where did you get that idea?

From the fact ODF “support” is an awkward import/export function. It’s not a first class format.

The code is open so where do you suppose all this supposed spyware is hiding?

On their live service. They don’t publish the spyware with the code they choose to open, obviously. 😃

It can import your Steam wishlist and give you tons of examples. 😊

Here’s some: Civ 5, Disco Elysium, Yakuza 6, Borderlands GOTY, Outer Wilds, Doom Eternal.

You can also make filters that limit the suggestions to a certain sale percentage (eg. 50%+ off), or to a max price (eg. $10).

Here’s the AUR recipe (PKGBUILD file) for a random package:

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=nautilus-git

This is a standard format for the recipe. It’s Bash code used to define variables and functions.

You’ll notice there’s no place to sneak in a Python script. There is some brief Bash code in the functions but any major stuff would stand out immediately. So would an command that fetches a malware zip from a weird URL.

Meanwhile, if you add node or python to the dependencies, and then run a command that installs a perfectly legit npm or pip module, nobody would bat an eye. It’s impossible to figure out that among the many upstream dependencies of that module there might be one that was subverted to discreetly run malware.

AUR is a very bad idea tbh and should not be used by the faint of heart. It makes it entirely too easy to pull this kind of crap.

Add mTLS to the reverse proxy and to the Immich client app and forbid access without it.

The mTLS certs can be self-generated. There are tutorials for generating your own CA and individual mTLS certs for each device. Then you put the ca.pem file in a place accessable by NPM and add a couple of commands to the “Advanced” tab of the Immich proxy host, and you put the mTLS cert on the phone and load it into the Immich app.

mTLS is a super strong method, not only does it serve as great authentication for that particular device, it also checks the TLS connection for tampering so it can’t be hijacked even if somehow you get rogue certificates loaded on your phone, you can revoke certs if your phone gets lost or stolen etc.

It supports it on the iOS client as well but last time I tried it would always lose the mTLS setting on its own after a while. I had to resort to the other method they offer, secret key in a custom HTTP header.

DAVx5 also includes good security, like the ability to use mTLS to secure your access to Radicale adequately even if you expose it over the open Internet. It’s also being actively developed, with updates coming out every few weeks.

InfCloud is the last and only functional, standalone, web-based CalDAV frontend currently in existence. It doesn’t really matter how crap it is because there’s no alternative. And besides CalDAV/CardDAV are not exactly rapidly-evolving anymore.

There are a handful of alternative frontends bundled with other webapps, for example Nextcloud includes one, but if you don’t want to install Nextcloud just for that you’re stuck with InfCloud.

I really wish someone would make a modern standalone webapp for this but no luck so far.

Having worked at some point on some calendar interfaces I can appreciate why, because they’re super intricate and difficult.

Start by using a 3rd party contacts app (or dialer+contacts as they usually come, at least on Android). Google’s Contacts app only works with Google.

The 3rd party app should let you explicitly select which sources of contacts you want to use. After you set up DAVx5 you should see it available as a source.

The app I use (True Phone, com.hb.dialer.free) shows a list of all sources under “Settings > Contacts > Contacts to show” and you can check/uncheck the ones you want.

AUR “packages” are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager.

Normally it’s a source tarball downloaded directly from the project’s Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc.

Point is, you can’t inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious.

So what they do is add the malware to modules published on another platform, and they’re downloaded indirectly, as a dependency of the Nth grade.

It’s very hard to detect, you can’t really notice this kind of attack with a glance at the recipe.

But if you go on isthereanydeal.com you will see a whole bunch of online stores that offer sales on games. They offer Steam codes too but are not limited to Steam, they cover many other platforms (including Epic).

(Those btw are all legit sites showing only sales endorsed by the game publishers themselves, they all sell new game codes. ITAD has a standing policy to only source from that kind of sales, strictly no key resale sites.)

So if you can get Steam games cheaper than are currently listed on Steam, and many games are also available on GOG which is DRM free… not entirely sure what this lawsuit is about.

Because the NPM is a complete mess and it’s super easy to exploit for supply-chain attacks by sneaking malware into one of the billion dependencies required by most popular packages.

OnlyOffice is not related to OpenOffice. OnlyOffice is developed by Ascensio System which has labored to obscure their Russian backing.

Whereas StarOffice/OpenOffice/LibreOffice is a product officially developed by Sun, then donated to the Apache Foundation, then forked as LibreOffice governed by The Document Foundation.

https://en.wikipedia.org/wiki/OpenOffice.org#Forks_and_derivative_software

I got several jobs through it. It’s good place for its core goal, which is to be found and to look for posted openings.

All the other crap is pointless: posts, discussions, trivia, games etc.

The identity verification is a mixed bag.

It’s mostly pointless in the EU because each country has a government body that tracks each ongoing employment contract for the purpose of tax, insurance, credit, work laws, regulations etc. So you really cannot misrepresent yourself.

But there are shenanigans like fake profiles made by bots, or someone putting up a profile pretending to be someone else who may or may not be already on LinkedIn etc. Not sure how you can weed those out without some sort of identity check.

There are however better ways to go about it. For example the EU countries have been (slowly) coming up with benign forms of identity checks.

My country has an online identity platform ran by the government directly, where citizens can enroll voluntarily and use it to perform federated login to other government platforms, and can also see and approve what personal details are shared with those platforms when they do. It’s a completely voluntary alternative to the good ol’ way of making a different account with every government website. (I’m still floored they had the insight to make something so nice.)

So anyway it hasn’t been opened to commercial entities but I could see it be safely used in the future to confirm to a company like LinkedIn that you are indeed a live citizen and nothing else. Just a live API “yes” response with a hash of the citizen ID number; no pics, no data to store.