Show newer

cleaning mastodon media, performance might be impaceted (88984 to go)

@goat@hellsite.site small focks against giant holly goat is like the exact reversal of irl, how did we get here

@goat@hellsite.site hahahha how am i so small???!??

@doubleDensity
0000000 861a f268 9a34 e42d 9071 08e3 769a 3949
0000010 428a 0afa 498b ad39 9423 4a3d 1673 d517
0000020 af1b 317e ea8c 13ba 0770 57f6 f1aa 56f1

@SuricrasiaOnline standard emoji are way too domesticated, only 🤔 has some form of expression

@haskal systemd is so great for security, I've been writing my services with ProtectSystem and only allowing read/write to very specific folders :3
also DynamicUser when it doesn't matter permission-wise

hasakl tech tip

need to do some dev stuff that needs capabilities like binding to a privileged port, or managing wireguard interfaces, without using sudo (because you don't trust your program not to fuck up root access. also it's security)?

systemd-run can do it (systemd-run can do literally anything. you'd be surprised)

systemd-run --pty -S -pAmbientCapabilities=CAP_NET_ADMIN -pUser=$USER -pGroup=$USER

systemd-run creates an ephemeral unit
--pty hooks it up to the current terminal
-S starts a shell as the process
-p sets a property
AmbientCapabilities=CAP_NET_ADMIN gives the unit the CAP_NET_ADMIN capability. you may also be interested in stuff like CAP_NET_BIND_SERVICE and CAP_NET_RAW
User=$USER and Group=$USER runs it under your actual user instead of as root

oh yeah irccloud got fully k-lined for speaking out against leenode

and like, when I get into it I think I write pretty well so :)

Show thread

i did a good bit of writing, bit less stressed about thursday deadline now

Show older
Pixietown

Small server part of the pixie.town infrastructure. Registration is closed.