• 4 Posts
  • 432 Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle
  • It’s really going to depend on what you’re trying to do.

    How did you set up your lemmy instance? Did you use the ansible script?

    Which part in particular are you having trouble with?

    One puzzle piece you may be missing is that you’re going to have two different websites (a photon one and a lemmy-ui one) and they will (I’m assuming) both be on the same server. You’ll need a way to direct traffic to the right place, and that way is a reverse proxy. You might reuse the nginx that Lemmy uses, but I find it’s cleaner to leave Lemmy to do it’s thing and set up another reverse proxy (which might be another nginx or it might not). Some other popular ones are nginx proxy manager, caddy, traefik, haproxy.











  • I can see both angles of this. Especially since the original disclosure didn’t have the full detail of how it could be exploited to access company systems, and they (the writeup author) never disclosed that update.

    You can see how a large company (Zendesk) could miss this in the multitude of people trying to claim bug bounties. I fully believe that had they understood the issue they should have fixed it, since it’s within their power and basically a service to their clients. But I can understand how the limited detail in the original disclosure demonstrated a much lower level risk than the end exploit that was never reported.



  • They aren’t trying to actually send from that email, they are trying to create an Apple ID that lets them log in using that email effectively as a username. And Slack will add people to the internal Slack if the email is a company email address.

    To open that account, they need to prove to Apple they own the account. They sign up with Apple and say their email address is [email protected], then Apple sends them a code to verify it’s their email.

    They can’t actually receive the verification email, because it’s not their email. That’s where the exploit comes in. It’s very important that this email address is the one that forwards emails to Zendesk. The verification email from Apple goes to Zendesk, then they use the exploit to see the history of the zendesk ticket, which includes the verification code.


  • Dave@lemmy.nztoAsk Lemmy@lemmy.worldCouch co-op thread
    link
    fedilink
    arrow-up
    0
    ·
    edit-2
    6 days ago

    It sure does. It’s quite different to other games suggested in this thread, but if it’s the kind of game OP is wanting to try then it’s very good as a couch coop game (on PC, not sure if supported on other platforms). Though I get the feeling OP is looking for action or round based, rather than a quiet tending of a farm and exploring the local area.




  • I’m not gonna subscription my heated car seats but search is a service that costs an ongoing amount to provide. The subscription isn’t significant, it’s $5 a month for 300 searches (or $10 for unlimited).

    I know we’ve been conditioned to expect search for free, but if we want to get away from the “the user is the product” model then I think it’s a good thing to have a subscription to a service that has ongoing costs to provide.