• 0 Posts
  • 25 Comments
Joined 2 years ago
cake
Cake day: November 16th, 2023

help-circle








  • A couple points:

    • Your website does not properly convey the technical context of Safebox. Docker is a complex platform, and asking someone to install it point blank on any OS, while also championing ease-of-access feels at odds here.
    • There is a severe lack of documentation about the tool. Discord is not an appropriate means to find these documents if they exist. It is rarely okay as a support channel.
    • I saw your post from a few days ago, but it was framed as a question about about gatekeeping specifically. The post also advertised Safebox. Given that the post no longer exists (but the comments sure do), I’m inclined to think you didn’t get quite the answer you were looking for.

    I dove into self-hosting several years ago and ultimately I think I found the experience quite welcoming. I also don’t know that Safebox has a lot to offer over well-established alternatives these days like Unraid or TrueNAS, which have large user-bases and a depth of support articles to help admins better understand what they’re doing and how to do it. It’s true that not everyone would want to do this as a hobby. No one wants their services to break, or their data to be lost, and more tools that make it easier to prevent these scenarios are helpful. With that in mind, I am not left with a clear understanding of how Safebox is meant to provide safeguards here.

    I used the word “admin” in the previous paragraph for good reason. Self-hosting makes you the administrator, and it means that you, the administrator, have the power to make mistakes. My recommendation is not to talk down to your users. Someone interested in self-hosting should be aware of the potential security implications of what they’re taking on, alongside the risk to their data and that breaking changes are something they can and will make along the way. If you really want to make self-hosting accessible, then the documentation for your tool needs to be accessible too.

    Safebox runs on Linux, macOS, and Windows, supports both x86 and ARM64 (including Raspberry Pi, Banana Pi, and others), and handles domain/subdomain setup, Let’s Encrypt certificates, DNS configuration, reverse proxy (nginx), and also offers WireGuard-based remote access.

    A user should be able to learn why these elements are important and how they work together. Talk about the limitations of running it on a raspberry pi vs a workstations or server. What’s a reverse proxy? Is WireGuard good? This doesn’t mean the average person needs to know how to configure detailed permissions or application configs, and if the goal is to provide a repository of pre-hardened Docker configs for use then that’s cool too, but there should never be a barrier to the information itself. Especially as it is relevant to the tool you’ve built.

    I think that fundamentally, you’ve built a good tool that simplifies things someone who is already familiar with its components, and where it needs to improve is by expanding to help new users familiarize themselves. Education is as big a part of accessibility as the ease-of-setup.








  • Flatpaks are basically containers, allowing applications to maintain their own dependencies separate from your system. It’s similar to a Windows program shipping with its own precompiled DLLs, helping prevent dependenct conflicts when you go to update something you installed with pacman or yay.


  • Arc support was added after release to Linux Kernel 6.2 and it’s steadily improved since. Older Linux distros, or “LTS” oriented distros that favour stability may still not have support for them. I know Unraid was very slow to pick up on it and I had to settle for passing the pcie device through to a VM to get it working. Intel is keen to made these viable though, and I love having the AV1 encoder from my A380.


  • That one sounds squarely on Nvidia. Any driver that uses undocumented workarounds to gain kernel level access or utilizes an access loophool for system hooks is a bad driver. I’d assume Debian, or likely more accurately the Linux kernel itself was updated following some matter of CVE that Nvidia was quietly abusing.

    Frustrating, but a good example of why those kinds of proprietary drivers are such a nightmare. You really just don’t know what techniques they’re using.