I usually setup debian or ubuntu servers. One of the pain areas I have avoided is email and usually just off-load the email to a 3rd party service. I currently need to setup a server with an email server and need a really simple straightforward tutorial. I thought I would see if the community has any suggestions.

This is a recurring post to discuss programming or other technical projects that we've been working on. Tell us about one of your recent projects, either at work or personal projects. What's interesting about it? Are you having trouble with anything?

It's been a hell of a year but we've just about made it, even managing to keep some sports going through it all. How about we look back at the best, the worst, the biggest, the weirdest stories of 2020? Even with keeping my eye on the weekly round-up threads, I know I've missed more than a few.

There are lots of retrospectives about famous people that died and depressing virus talk on the news. But life is full of apparent contradictions and it is not uncommon to find joy even in the most desperate situations. What are some things that made you happy in 2020? Anything, personal or not.

General Programming Q&A thread! Ask any questions about programming, answer the questions of other users, or post suggestions for future threads.

Don't forget to format your code using the triple backticks or tildes:

Here is my schema:

```sql
CREATE TABLE article_to_warehouse (
  article_id   INTEGER
, warehouse_id INTEGER
)
;
```

How do I add a `UNIQUE` constraint?

I built a link sharing website where you connect to users that share your interests. When you upvote a link - you connect to other users who upvoted that link and LinkLonk shows you what else these users upvoted.

The more in common you have with another user the more prominently their other recommendations appear on your list.

The intuition is that the more useful your past recommendations have been for me, the more I can trust your future recommendations.

This is how trust works in meatspace - we keep track of how positive our experiences have been with other people and use that track record to decide who we can trust in the future.

Except that mechanism does not work online. It just does not scale to the numbers of users we interact with. We can remember around 150 other people (the Dunbar number). Beyond that our builtin trust mechanism breaks down. We revert to more coarse and primitive trust mechanisms such as tribalism and mistrust in everyone.

While we cannot personally keep track of every user on a platform - that is what computers are good at.

That is the idea behind LinkLonk. You don't need to remember the names of users who you can trust (in fact there are no usernames on LinkLonk). You simply upvote content that was useful to you and LinkLonk constantly keeps track of how useful every other user has been and ranks new content accordingly.

Another important part of trust is that if you misplace your trust in someone and they let you down then you need a mechanism to stop trusting them.

This is what the downvote button is used for: when you downvote an item, LinkLonk reduces your “trust” in other users that upvoted it. As a result, you will see less content from those users.

The above describes the basic idea. There are a couple more concepts:

• You start off weakly connected to all users, which means that at first you see content sorted by popularity. Rate something and refresh the page - the ranking will change.
• You are not limited to a single persona/interest. If you have multiple interests then you can create a separate collection for each of your interests. When you upvote a link you can choose what collection it belongs to. For example, if you are interested in woodworking and music then you can create two collections and put woodworking links into one and music links into the other. Then other people who liked your woodworking recommendations will only see your other recommendations from the same collection and will not get your music. This is mostly a way for you to help other users find relevant content. It’s optional. You can put everything into the “default” collection if you don’t feel like organizing.
• LinkLonk has another source of recommendations - RSS feeds. When you upvote a blog post LinkLonk connects to the RSS feed of that blog - as if it was another user. LinkLonk pulls updates from the feed and shows you the new entries using the same ranking algorithm: the more you upvote items from the feed the higher the other items from the feed are ranked. You can submit any RSS url and LinkLonk will connect (subscribe) you to it. My hope is that in the early days when we don't have many users you would find LinkLonk useful as a sort of an RSS reader.
• Moderation. When you downvote an item then you get connected to other users who also downvoted that same item. In other words, you will trust their other downvotes. If they downvote something then that item will rank lower for you.

Give it a try at: https://linklonk.com/register with 'tildes' as the invitation code. The invitation code can be used multiple times and I will keep it active for a few days. After that please DM me to get a fresh code.

I’m posting this on Tildes in part because I like the group of people that Tildes has attracted. And I also feel the topics of trust systems, content curation and moderation are relevant to Tildes and to its users (see: https://docs.tildes.net/future-plans#trustreputation-system-for-moderation).

What do you think?

As part of a weekly series, these topics are a place for users to casually discuss the things they did — or didn't do — during their weekend. Did you make any plans? Take a trip? Do nothing at all? Tell us about it!

I see some people using NixOs on their servers. I would like to try it out to self host some services and learn about NixOs.

I use hetzner and they have an NixOs iso available so I can just use that to install NixOs. But how do people manage remote instances of NixOs? They would just use ansible or something like it, to run nix on the host, or is there a better way?

Thanks

What have you been doing lately for your own fitness? Try out any new programs or exercises? Have any questions for others about your training? Want to vent about poor behavior in the gym? Started a new diet or have a new recipe you want to share? Anything else health and wellness related?

Sunday Security Brief

This brief covered a unique attack vector, information on a broad campaign using DNS attacks, a case relating to technology law, and a few advisories that either stuck me as important or curious.

What happened last night can happen again ~ fortune

Topics:

• IDN Homograph Attack
• A Deep Dive on DNS Hijacking Attacks
• Law enforcement has seized the domains and infrastructure of three VPN services being used for cybercrime
• Advisories

IDN Homograph Attack

This particular exploit is interesting. It takes advantage of the fact that many different characters look alike to mislead people from their desired domain to a malicious one. I wonder what practices could help avoid this issue. The obvious step is to be concious of limiting the links that you click on from websites like Tildes, Hacker News, Reddit, or where anywhere can share a link with you via text. For example, if you see a Reddit thread about PayPal where someone includes a link to the PayPal Customer Service Center... Don't click it, just Google "PayPal Customer Service". This will be far safer in ensuring that you're going to the domain that you meant to!

Another thing to note is the importance of realizing how your trust online and how that changes your behavior. I know that I have a general sense of trust for people here that removes a lot of doubt when it comes to clicking random stuff you all share here. That trust could potentially work against you.

"The internationalized domain name (IDN) homograph attack is a way a malicious party may deceive computer users about what remote system they are communicating with, by exploiting the fact that many different characters look alike"

"The registration of homographic domain names is akin to typosquatting ~ Wikipedia, in that both forms of attacks use a similar-looking name to a more established domain to fool a user. The major difference is that in typosquatting the perpetrator attracts victims by relying on natural typographical errors commonly made when manually entering a URL, while in homograph spoofing the perpetrator deceives the victims by presenting visually indistinguishable hyperlinks."

IDN homograph attack ~ Wikipedia

A Deep Dive on DNS Hijacking Attacks

The article covered is a few months old, but still relavant as ever. The U.S. government alongside private security personnel issued information of a complex system that allowed suspected Iranian hackers to obtain a huge amount of email credentials, sensitive government and corporate information. The specifics of how this attack occured are not publicly available but Cisco's Talos research has a write up of how DNS Attacks work, the relavant snippets are below.

"Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets, so that all email and virtual private networking (VPN) traffic was redirected to an Internet address controlled by the attackers."

"Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains (e.g. webmail.finance.gov.lb), which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text."

"A Deep Dive on the Recent Widespread DNS Hijacking Attacks" ~ Krebs on Security

Law enforcement has seized the domains and infrastructure of three VPN services being used for cybercrime

The balance between allowing autonomy and protecting our collective interests comes to my mind. This seems like a worthy example of when stopping people from victimizing others overshadows the benefits of free action.

"Law enforcement agencies from the US, Germany, France, Switzerland, and the Netherlands have seized this week the web domains and server infrastructure of three VPN services that provided a safe haven for cybercriminals to attack their victims."

"... described the three as "bulletproof hosting services," a term typically used to describe web companies that don't take down criminal content, despite repeated requests."

"According to the US Department of Justice and Europol, the three companies' servers were often used to mask the real identities of ransomware gangs, web skimmer (Magecart) groups, online phishers, and hackers involved in account takeovers, allowing them to operate from behind a proxy network up to five layers deep."

Law enforcement take down three bulletproof VPN providers ~ Zdnet

Advisories

• Debian, DSA-4824-1 chromium security update. Source

• Arch, CVE-2020-25637 libvirt. Source

• CentOS, CESA-2020-5437, Important CentOS 7 kernel. Source

• RedHat, RHSA-2020:5665, Important: mariadb:10.3 security, bug fix, and enhancement update. Source

• Windows, If you know of a good tracker for Windows securities advisories, please let me know. I was considering just drawing from the Microsoft Security Response Center Blog.

This thread is posted weekly, and is intended as a place for more-casual discussion of the coronavirus and questions/updates that may not warrant their own dedicated topics. Tell us about what the situation is like where you live!