Fórum Level1Techs Forums

yes, i have encrypted the web management UI without SSL you won’t be able to access to the WebGUI… i need a feasible solution to control the real services (e.g. blocking TCP-443)

Oh you might want to set a ACL (acces control list) on it. Btw mTLS as in all internal trafic is encrypted between hosts and severs? There is also a old packet layer switching technology with the same mTLS abreviation. Took me a bit to get it clear for myself.

Well, the reality of the job market in the UK is that salaries in tech are dropping thanks to AI and idiot managers thinking it can do people’s jobs without the remaining AI-operating staff losing their minds - it’s currently not a candidate-friendly environment. That means Joe will probably be paying less tax than he was…so lower tax yields just as a pension and healthcare funding problem, because we’re hitting the maximum of retirees as the baby boomers retire right at the same time as we hit the bottom of the birthrate problem from the early 2000s. And that’s coming at the same time as the financial time bomb caused by the student loans problem (the first loans from Blair’s era are going to start being forgiven shortly - that’s an asset on the government books that’s been masking a huge hole in the budget that runs into the billions).

I am trying to understand Ubuntu’s TLS certificate trust architecture at a general level. By “trust backend” I mean the mechanism or certificate store an application uses to decide whether a server TLS certificate chains to a trusted CA. I have encountered several mechanisms on Ubuntu, including: the Ubuntu system CA store ( /etc/ssl/certs , ca-certificates ) NSS certificate databases Firefox/Mozilla profile or policy-based certificate handling p11-kit / PKCS#11 trust Java cacerts / Java KeyStores application-bundled or private/custom CA stores I am not assuming that these are six completely independent backend technologies; some may overlap or be management/isolation layers around another backend. My questions are: Does Ubuntu define a finite, authoritative number of TLS certificate trust backends? Is the list above exhaustive, or can applications use additional/custom trust mechanisms? Should Snap and Flatpak be counted as separate trust backends, or are they isolation environments that can contain private instances of an existing backend such as NSS? Is Mozilla/Firefox technically a separate backend, or mainly an NSS-based store with Mozilla-specific profile/policy management? I am especially interested in answers backed by Ubuntu documentation, upstream documentation, or source code.

Hey, thank you for your reply. My current setup is illustrated in the second picture. I need to block specific types of network protocols (TCP, UDP, etc.), mainly port 443. Since I have deployed mTLS on the OPNsense router located upstream, it does not manage the IP tables. I want to block the web management of the devices located under the core switch.

I have this one drive that started showing read errors i did the same fix with a low level format but looking at the SMART data is seems as it had the lifetime hours reset… Smart Data (click for more details) I think i had pulled this drive from a PC that someone gave me to recycle and it has been since then in my server as an NVR drive for one camera i think at least a year or two so it doesn’t make sense to me. Just posting this here as a curiosity. Would you still use this for not that important nvr?

Rogue-agent: Hello World! So having, watched the Luis Rossman: Random Live video on GrapheneOS. Now I saw the recommendation “Why I deleted GrapheneOS”. My questions/concerns are: Is Graphene OS still viable as a privacy focused Android fork? Are there others? What could be the future of Graphene OS Can this project still be saved from dissolution? Is it finally time to go Pine Phone and Pine Time? I’ve been thinking as the important things I can still do as per Web App, banking, emails and whatnot. I want to look at this project and situation completely objectively as the alternative is just opinions and are irrelevant to reality. Alvast bedankt voor the civil discussion. I’ve been using GrapheneOS for a while and, from my experience, it’s still a solid option if privacy is the main goal. The biggest thing to consider is app compatibility, especially banking apps. I’d be more comfortable sticking with a Pixel + GrapheneOS for now than moving to a PinePhone, mainly because everyday apps are still much easier to manage.

digitalscream: That’s a bold claim Its a reasonable assumption. Either enough joes find a new job and business continues as usual, or the economy craters and civilization falls, then everybody still alive after the fact finds a new job as a farmer

Hey I’m trying to fully understand what you are planning your explanation is not fully clicking. Migt be on me for not fully being awake. Do you mind me asking some clarification on 2 parts? Because I have two upstream firewalls, traffic is currently managed by the core switch (Level3) via routing and IP tables. I want to implement another firewall to manage and control the traffic between these services. You want to add a 3th firewall to manage traffic between some services. What are the services you are referring to? Second I have seen this specific topology before and want to deploy it, but I am not sure how to engineer a firewall connected to the core switch to handle this traffic segmentation. Any advice? Are you referring to the top image of the 2? with the example of the hierarchical layers in a high available setup?

that’s surprising, but honestly it was a wild guess

SlothUnleashed: Joe Bloggs is going to get another job , and he will continue to pay taxes like he always did. That’s a bold claim Seriously, though, AI is already taxed - VAT, at 20%. On top of that, Joe is probably going to use AI for his side-hustle (since we’re getting perilously close to the US-style “everybody needs two jobs and a side-hustle just to survive”), so that’s more 20% right there.

level1: “the SINGLE place to handle ALL applications” funnily enough, that is exactly what OP initially complained about. Not having one i mean. level1: Since normies can’t be bothered using the command line to bypass the restrictions of the Snap Store / App Center, the uproar will be muted when those options are removed completely down the track and the final walls go up. Are you seriously meaning to say that you think canonical is gona remove all shell functionality for installing or managing applications in the future? To be honest, to me that is like saying “aliens gona steal the moon tomorrow”. What in heavens sake makes you think they would do that? boarmeat: It is not one thing, it is 10 or more. What is the Unix/Linux philosophy? Do one thing and do it really well. Systemd flies in the face of that. As was made clear before, SystemD is also not just one monolyth of an application. There is room to argue that the parts of it follow that principle enough to be fine. boarmeat: One thing that bothers me is the Journal. It is binary files. If you try to read them manually, they make no sense. Which means if I have a machine that crashed and I cannot get it running again via chroot or similar, I cannot get ANY logs of what went wrong. No way that I know of. No way that you know of? This would be fair if you were looking into it at all. Lets say you have a machine you can’t get running anymore but you were able to extract a binary logfile from the drive directly. What do you