I think you misunderstand. They are making technical decisions that are incompatible with ux decisions. In order to make a better user experience they would need to change how the protocol was made, thus undoing thing that they chose for technical reasons.

Like the way they chose to do the custom emoji makes sense on a technical level for a de Federated protocol but it also is fundamentally incompatible with a good user experience. Same with the forest verification of devices that’s bad ux even if it is technically better

No it doesn’t, matrix was designed by people with no concept of ux. It focuses on things that are technically correct but something average people won’t put up with. Like the forced verification of devices, normal people don’t care and don’t understand what that even is and will be annoyed that every time they try to log in they are prompted to insert a stupid key just so that they can see their chat history.

Doesn’t help that tons of the clients especially the web one can’t be bothered to remember being authenticated and you have to do it literally every time but even with that fix just having to do that in general is going to put people off.

Then there’s just a bunch of base protocol stuff that’s dumb the way they finally implemented custom emoji is the stupidest thing I’ve ever seen and makes what should be a simple easy click to add a sticker and then use it turn into this complicated mess that nobody’s going to bother with. On a technical level it made sense sure but on a user experience level it makes no sense at all.

And I say this is someone that self-hosts basically anything I can get my hands on, I’ve got Seafile, immich, piped, jellyfin, microbin, among various others. I keep trying matrix and keep finding myself getting annoyed enough to stop using it

Eh, i just use pubkey only Auth config (so password entirely disabled as an option) and put ssh on a non standard port to reduce script kid noise. (and no 2222 is not non-standard it may as well be the default)

Fail2ban triggers false too often for my taste in a high traffic environment.

If you ran nginx as a non privileged user it wouldn’t be able to bind to 80/443 as those are privileged ports. So you would need to use iptables to forward them to an unprivlaged port

I mean it WOULD work you would just need a von on every device you wanted to use.

The REAL answer is never host them DIRECTLY, always use a reverse proxy like nginx. Many projects (i believe jellyfin is one of them) explicitly recommend this for better security. Which it looks like you did so congrats

For extra bonus points you can setup nginx to run as a non privileged user and use iptables to forward the lower ports (80/443). A pain but closes out a large chunk of nginx as a risk.

https://spartanhost.org/ owner is super chill will make custom spec deployments and they actually have a really nice management panels with nice easy custom iso support

One end is a local VPS with insanely good peering pretty much round the damn world, other end is my opnsense router. I actually pass a block of ipv6 through the vpn and my router hands it out to devices which is a nice little bonus

That sounds like a lack of port forwarding on at least one side. Ensure the vpn port is properly open on both sides. There is also an option you can add to the wireguard config for keepalive set it to something like 1min

I feel like im missing something here. This is pretty trivial and the comments i see are over complicating the hell outta everything. All you need is your VPN tunnel working. Personally i use wireguard for this. Then you just use nginx as the reverse proxy it talks to services on the other side of the VPN.

The nginx server config looks like

server { listen 443 quic; listen [::]:443 quic; listen 443 ssl; listen [::]:443 ssl; server_name my.domain.tld; http2 on; http3 on; quic_gso on; tcp_nodelay on; error_log /var/log/nginx/jellyfin.access.log; ssl_certificate /path/to/ssl/fullchain.pem; ssl_certificate_key /path/to/ssl/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; add_header Alt-Svc ‘h3=“:$server_port”; ma=86400’; add_header x-quic ‘h3’; add_header Alt-Svc ‘h3-29=“:$server_port”’;

location / {
    proxy_pass http://10.159.4.12:8096/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forward-Proto http;
    proxy_set_header X-Nginx-Proxy true;
}

}

I have no idea how to do the proper code block i guess so have a paste from my reverse proxy hosted pastebin lol https://paste.kitsuna.net/upload/snail-seal-pig

What? As long as it’s a good not Telegraphed twist it will be able to still be a good moment even if you know to expect one. You’ll be trying to figure it out the whole time and you’ll probably get it wrong multiple times along the way lol

I feel like this all started around that time that there was that article that mentioned the most popular desktop environments on Arch Linux from repo stats where KDE plasma was the highest with over double gnome.

Clearly gnome foundation salty

There’s nobody for me to join, the only family that are not horrible manipulative monsters are beyond my means of travel, currently it’s just me and the dog so there’s really no point in making an elaborate dinner for myself. So today is just me being bored and alone till friends become available again.

I don’t not celebrate it because Christian or whatever. I don’t celebrate it because there’s nobody to celebrate it with

Imagine not having an opnsense firewall deployed as an IT professional

Can you not just setup an nginx reverse proxy at the network edge to handle the ssl for the domain(s) and not have to worry about the app itself being setup for it? That’s how I’ve always managed all software personal or professional

Every time I get rid of them i almost immediately need to ship something and wish i had them. I keep them not because i need them but because I’ll need them if they aren’t there

No but there is a semi work around.

When using the app if you select all images one of your options will be delete from device when you click on that it will say hey some of these might not be backed up and one of your option is to only delete the things that have been backed up. It’s not automatic but it is a way you can kind of just Mass do it to everything

It requires neither of those upgrades though? Unless you’re still using Windows XP I guess for some reason. It’s just an update to the image decoder

In its default state i think thats fair. Example docker bypasses most firewalls as it runs before iptables rules process. So if you don’t either use 127.0.0.1:port:port (many compose files offered by projects do not do this) or add specialized iptables rules to fix that up you can end up directly exposing services with meaning to or even realizing.

And yeah privilege escalation etc. There are solutions like what you mentioned but it can be a lot of work to set all that up so most people won’t

There is literally a thread somewhere on my Lemmy I need to try and find just recently that shows this perfectly. Someone made a thread asking how they can self host their images for backup from their phone and naturally everyone pointed them to immich. And they immediately started complaining and bitching that they could not access it from outside their local network. Instead of asking how to fix that they were like what the hell is the point if I have to be on the same Wi-Fi this is stupid. And they basically did not want to engage with the people being like hey you need to either make a reverse proxy or open a port on your router. They should not be self hosting

You need to open a port on your router for it to be accessible from the outside world (example your phone on LTE or a different wifi) , this is not a limitation of the software but a security feature of your router