• 1 Post
  • 74 Comments
Joined 2 years ago
cake
Cake day: June 17th, 2023

help-circle

  • It’s not that bad that you might think, the db user just need to have readonly access permissions to specific database tables.

    Ofc all data in tables ofc need to be public, so more like simple public facing page, app should not have any notion of users in any way, data probably populated by some automated system, and UI just to make it easier for anonymouse users to view that data in a friendly way.

    On top of that it will be a hell for the sysops as they will need to know the whole db structure and such of even a single part of db would contain non-public data, but that overall the best guy to handle security in the first place.

    And because all data is totally public in the first place you could give the task of creating frontend to any junior or LLM and it will be still secure.


    But in truth it is very bad idea (even it it is possible), because most likely the database connections would be reused so you could for example change current connection session timezone or other params and that ofc would nit change the data in db but still could affect other users by showing wrongly formatted or shifted data.





  • For steam, shutdown it and start it from terminal to see logs from steam and games on screen. Then start the game that doesn’t want to start and paste those logs. Because 99% of time clue for the reason why its failing is in the log.

    You dont need to use this method to get the logs maybe there is a simpler one foe your setup, like look for those logs in journal or any other place but thats how I did investigate why some steam game didn’t start. But I did have native steam, not flatpak one. For flatpak you might need some flatpak run something.something command, it should log a lot of text, if not then maybe need some --params to not go into background.

    Overall this method works for most stuff, logs are the holy grail of any app when debugging and (almost if not) all linux run app does output those :)




  • kolorafa@lemmy.worldtoPrivacy@lemmy.mlIs F-droid insecure?
    link
    fedilink
    arrow-up
    0
    ·
    edit-2
    4 months ago

    Those plastic rectangles doesn’t have any security against range extend attacks so they can steal money from you and you would be plain unaware and defenses. While phone or watch will only enable contactless payment on demand making it way safer. And you can pay with contactless payment everywhere in Poland while you sometimes can’t pay with inserting physical card on some automated devices as there is no where to insert that card, you can only use contactless feature of that card.

    Not to mention those plastic rectangles cost yearly or sometimes even monthly, while app is 100% free. And if the app at any point in time do anything that I didn’t agree in the agreement and/or bypass any permissions I didn’t grant them there will be hell to pay for them.

    But maybe I’m wrong, I don’t know…




  • kolorafa@lemmy.worldtoPrivacy@lemmy.mlIs F-droid insecure?
    link
    fedilink
    arrow-up
    0
    arrow-down
    1
    ·
    5 months ago

    In case of f-droid, it’s follow more the Linux distro phylosopy, where the binaries are build and offered to you not by the developer but by distro/repository maintainers people.

    You can add your own repository or use your friend repository or use f-droid ones.

    In case od f-droid repository, to get app published your app need to adhere to rules one of them is that the code need to be public so the repo maintainers can build the app from it.

    Comparing it to play store where the app is build and sign by the developer without making the code public, in turn making it almost impossible to know and follow what the app is doing.

    So its a matter of trust.

    For some apps I would rather install them from f-droid as I have higher confidence that someone looked at it if the app is not harmful or leaking my private data. For other apps like Banking apps I would rather install them from Aurora store where I dont know what the app is doing but I trust more to protect my money than some random dude on internet. And if bank does something bad I will sue them or just stop using their service.









  • Best to buy phones that you can relock your bootloader, from memory I can only think of 2 phone manufacturers that allow that: Fairphone and Pixel phones that allow you to relock bootloader.

    I bought Fairphone 5 with Degoogled /e/ OS from Murena to avoid that annoying cat and mouse game. I bought from murena website to get my phone already with degoogled firmware flashed.

    In my case bootloader is locked with google attestation so 99,9% apps works, including Banks apps with TAP to pay. Bank payments that dont use google pay but implent NFC directly works (so except for google pay other pay method should work).

    Both my bank apps works with tap to pay, But Your milage may vary.

    Im happy with my phone. Due to all that, not a single app had issues with “valid OS checks” because it actually is valid, it did came directly from seller and never got unlocked/flashed.

    It is locked but I should be able to unlock bootlader, flash different firmware version and lock it back up making the attestation valid again but didn’t do that yet so can’t be 100% sure.