If OP is a journalist or refugee at risk of being targeted and killed, my advice is don’t use a VPN, use TOR lol.

Not untrue, and I don’t think that the possibility should be glossed over, but honestly, what do you think is more likely: this specific person getting specifically MitM’ed by a bad actor, or a bad actor taking control of a repo that hundreds of people blindly trust. I have a sneaking suspicion that OP’s threat model isn’t sophisticated enough to need to really, truly, be worrying about that.

What are you on about? If you are using the 3rd party repo, you are just as likely to get malware than if you download the deb directly from the wbsite. Its literally the same thing, just adding the repo means that the malware could get installed automatically and without you knowing where it came from.

When big dog acts out: “ahh that breed is aggressive! 😡”

When abused purse dogs act out (more frequently and more viciously): “oh isnt he just adorable 🥺”

I believe this wholeheartedly. I work for an mcsp, and we have a client who runs a chain of “news” sites. They are buying a bunch of AI server equipment for their racks and we are almost 100% certain its to pump out garbage for the election.

IIRC it only suports plain text files / Markdown rn. Not supporting EPUB is a non-starter for me. I use my Kobo right now and love it. If they add EPUB support i will heavily consider building one.

Well hey this might be what im looking for! Lol. Ill take a look, thanks!

I would love to move off last.fm, but this doesn’t support Plex, so that’s a no-go for me… I did create an account though, so once they do I will happily move over lol.

LOL

You talk a confident, condescending game for someone who cant substatiate any of their claims lol.

EDIT: Dear lord after looking through your comments i regret enabling you. Fuck isreal, free palestine, AI is overhyped…

I just had to switch my work computer from Arch to Ubuntu becusse they want MDM on all computers now, and flatpaks are litetally the only reason i can tolerate it.

I now prioritise getting stuff from flatpaks, then the repos, and if they dont exist i use Distrobox to export any app thats only on the AUR for example.

Bitwarden is so good. I cant be bothered to self host it tbh, but ill gladly throw money their way for premium for having the best cloud-hosted PW manager

Just setup cert-manager for a client at our work thats moving to a Kubernetes cluster. Setup the ACME issuer using DNS Cloudflare challenges, its awesome how simple it is to even get internal hostnames with certs.

Ads like this really arent all that scumny my dude, i mean at least IMO lol.

You gotta pay the creator to use the app. Sync isnt free, You either pay with ads, or you pay with your buckaroos. Thats just how it works. And its pretty transparent. No trying to dupe you, hes not secretly selling your data (at least as far as i know). Either view ads so he gets paid, or pay him directly. I dont see anything wrong with this business model. The issue i have with ads is the intrusiveness of them, or the stealth of them. Reddits ads are scummy because they look like reddit posts, thats not cool.

Implementing ads after getting a user base (like in your lemmy.world example) is different because they are changing the model. If i were to join an instance that started off with ads, id be less miffed because if i like it enough i can stay and view ads / pay, or i would move to a different instance. I wouldnt call it scummy. I would understand that they gotta pay bills to keep that server on, and thats how they decided to do it.

For what its worth, i am a FOSS guy all the way, and take all opportunity to block ads. But im also willing to pay for software that i think deserves it. I donate to my lemmy instance, and have paid for Sync Ultra, because they are both great and the maintainers deserve to get paid :)

I also have a foldable, and forgot how much i missed using Sync because of the foldable support. Got it today and am in love all over again lol

Its worth noting, you cant actually MITM most traffic without device acess. To MITM my lemmy traffic, you would need either a copy of the certificate and private key of for example lemmy.world, which they would never willingly provide, or you would need to get a valid certificate from a CA for lemmy.world, which you could never get without verifying ownership of the domain.

If you are using a company owned device to browse Lemmy, then 100% they can very easily install a custom Root CA and make their own certificates, and you should assume all your traffic is monitored. But if they allow BYOB or for your phone to be on the network, then they would be unable to see that traffic without you being able to tell, because you would get certificate errors.

But if they allow you to install a VPN, then just use TOR with a TOR bridge and you wouldnt have issues, because they cant tell its VPN / TOR traffic akaik

Awesome, thanks for the feedback!

The callbacks not being widely known about was my concern as well, as I had only heard about them when researching a solution for this, lol. I’ll probably stick with my solution, and write a page in the documentation describing what they are and how to use them, to hopefully make it clear.

Ill take a look at Traitlets too! Thanks!

yup! I enjoy their CI stuff more, and its not owned my Microsoft, so thats a plus :)

Plus we use gitlab selfhosted at work, so its just what Im used to.

Oh man, you’re right! Whoops. I’ll go ahead and add that, lol.

I appreciate that! Glad im not doing anything horribly wrong… I’ll have to play around with the init script to see how to make it easier to get the needed functions.

I do have a pertinent question I forgot to ask about in my main post if you have some time, though. I am using SocketIO for their realtime API, and needed to figure out how to pass events received from the socket onto the client that is using the wrapper. I opted for requiring callback functions to be registered for the different events we could receive, that way they can choose what functions they want called when we get the event, but is that the best way to do it? I couldn’t think of any other method to pass that event in an async fashion, lol.