Hello there!
I’m also @savvywolf@furry.engineer , and I have a website at https://www.savagewolf.org/ .
He/They
I think realistically the best option is to stick with an older version of KDE until your issues get fixed upstream or switch to another DE.
Anyone technically literate enough to port KDE back to X11 is likely also literate enough to fix the blocking bugs.
… Unless they’re doing it purely on ideological grounds, which is probably not a healthy way to run a project.
Two factor authentication won’t help here. You have to build your app with the assumption that any attacker has a valid login and credentials and therefore restrict them to only information they have permission to see.
File uploads are encrypted in transit from the client to the server but not encrypted on the server.
Usually when people talk about e2e encrypted messaging they mean that everything is encrypted. That includes images and text content. The server should not be able to read any contents of any message sent through it.
Again this is a design choice I don’t want gifs.
Why? Sending memes is a core part of any social media experience.
There are filetype checks on line 350 of the app.
Line 350 in both files doesn’t seem to contain any filetype checks. I assume you mean file.content_type. That may not be accurate to the actual file uploaded; it can be spoofed.
Yes deleting is atomic.
# Delete the associated message if it exists
if chat_file.message_id:
msg = db.get(Message, chat_file.message_id)
if msg:
db.delete(msg)
---> Here
# Delete file from disk
file_path = os.path.join(CHAT_FILES_DIR, file_uuid)
if os.path.exists(file_path):
os.remove(file_path)
If the application crashes/closes at the indicated point, then you will delete the message from the database but still have the image on the server. If this is an image served from /img/whatever, it would have no checks beyond a login check.
to the extent Tor is secure
Tor doesn’t automatically secure your app. If your social media instance has 1000 users on it, and one user gets compromised, then the other 999 users shouldn’t have any interactions outside of that user leaked.
web crypto can be utilized for group and 1-1s for an additional layer of encryption
Are file uploads encrypted?
How would you ever discover a filename?
Maybe you have a data leak. Maybe they send the filename in plaintext somewhere. Maybe they take advantage of the fact that UUIDs might be deterministic. But if I may flip the question… Why does an inaccessible post even need to return 403 anyway? It just functions as a big footgun that may cause any other exploits to behave worse.
Even if you have the correct link, if those two conditions arnt satisfied you will not be able to view.
But you can determine its existence or not through the status code.
This was a design choice to have consistency in filetypes. What’s the downside? All browsers will support displaying a jpg.
Gifs will lose any animation, pngs will lose quality. Also, as far as I can tell, there’s nothing stopping a malicious user uploading a non-image file.
Which part are you talking about?
There are two steps to making a post: Upload and store the image and add the post to the database. There’s also similar steps to deleting a post: Removing the image upload and removing the post from the database. Are both these operations atomic?
Everything except the login page, registration link will behind these two checks see (def login) where the @loginrequired logic is defined for each of the app routes.
It’s not that hard for a sufficiently motivated adversary to get an account on a sufficiently large instance. You need to ensure that one user account being compromised doesn’t result in information leakage from unrelated accounts.
This discussion stems from issues I found in just one function. You’re making a product which requires a very high level of security. You need to understand how to write secure code, and your LLM won’t be able to do it for you.
I don’t want to discourage you from programming in general, but making a very secure social media site is a rather complex undertaking for someone new to programming.
You list “Activist/journalist secure communication” as a use case. Not all countries have freedom of press.
Looks like you name images based on a random uuid, so that should protect against filename attacks. But if you do have a filename you can tell whether the image has been an image or not.
Also, looks like all uploads are converted to jpg, regardless as to whether the original image was a jpg (or even an image) or not. Don’t do that.
Why not?
You say you’re not the sharpest tool in the shed, but I think gamedev is a good way to learn a variety of skills. And doing it as a hobby takes a lot of pressure off and allows you to take things at your own pace.
Had a quick skim and found this little guy:
# ---------- Protected media route ----------
@app.route('/img/<path:name>')
@login_required
def media(name):
db = SessionLocal()
try:
me = current_user(db)
# Find the post with this image
post = db.query(Post).filter_by(image_path=name).first()
if post:
# Check visibility
can_view = post.user_id == me.id or db.query(UserVisibility).filter_by(
owner_id=post.user_id, viewer_id=me.id
).first() is not None
if not can_view:
abort(403)
return send_from_directory(UPLOAD_DIR, os.path.basename(name))
finally:
db.close()
I’ve not read through everything, but there are some security concerns that jump out to me from just this function. Hopefully you can enlighten me on them.
Firstly, what is stopping a logged in user from accessing any image that, for whatever reason, doesn’t have an associated post for it?
Secondly, the return codes for “the image doesn’t exist” (404) and “the image exists but you can’t access it” (403) look to be different. This means that a logged in user can check whether a given filename (e.g. “epstien_and_trump_cuddling.jpg”) has been uploaded or not by any user.
Both of these look to be pretty bad security issues, especially for a project touting its ability to protect from nationstates. Am I missing something?
The move to storing everything in /usr/bin rather than /bin etc? I think it actually makes things more compatible, since if you’re a program looking for something you don’t need to care whether the specific distro decided it should go in /usr/bin or /bin.
There’s tons of backup solutions out there. Why should selfhosters buy a proprietary one?
For the swap space, yes that’s for when you run out of RAM. 48GiB is plenty of RAM, so you should be fine without it. I have 32GiB of RAM on my system and have been running without swap for ages without issue.
Hardening guides like that are mostly designed for things like web servers which are connected to the public internet and need higher scrutiny. The default configuration for distros like Mint should be secure enough for the average user.
However, don’t feel invincible and run random code from random sites. Both Windows and Linux can’t protect you against malicious code you run yourself.
Having organised partitions is the kind of thing that people obsessed with organisation do. For most people, the default partitioning scheme is fine. However, as always, remember to keep backups of important data.
For installing software, Mint has a Software Centre (which is distinct from the Snap Store). I’d recommend installing software using that for the average user.
In Mint, there are three main types of packages:
Mint’s software centre is able to install both Debian and Flatpak packages. I’d recommend using it where possible since it allows automatic upgrades and easier installation/uninstallation.
Don’t know if this is true for all environments, but you might be able to just create a file in ~/Templates for it to show up in that list.
This is why you use Arch/Nix because the package is likely in their repos.
The software probably still won’t work, but you can waste more time on it.
I don’t know if they still do it, but Mint used to do staggered updates (through their update manager) for some packages. They would start out making the update only available for, say, 10% of people and then slowly built up to 100% if no issues were discovered.
One thing that many guides tend to skip is how to install software. People coming from Windows might try to install software the “Windows way” by going to the website and downloading them. That is just likely to cause pain and suffering for a number of reasons.
Instead, every beginner friendly distro has its own flavour of software centre that users should be encouraged to use instead. Maybe even include a link to flathub in the guide or something.
Nowadays I find myself checking changelogs to see what features they’ve broken and what AI features I now need to disable…
Encryption and offsite backups. If someone nicks it then they don’t get any private information. And with backups it’s easy enough to just push the data onto a new device.
Ubuntu 25.10 entered beta on September 18th. It releases on October 9th. It’s still in beta.
… Yeah? Beta software having bugs isn’t the hottest of takes.
I’m willing to bet that if the GNU coreutils getting bumped a minor version caused widespread issues for a day, nobody would even bother reporting in it…
So, to address the elephant in the room… Why does commenting on a blog post need any kind of account? Why not have fields for “name” and “comment body” and use capcha and/or manual approval to guard against spam?
Like, why does everything need to be tied to an account nowadays?
If you do a port scan on your box, what services are running? Maybe something like email or diagnostics is exposed to the internet and announcing subdomains?