• 0 Posts
  • 125 Comments
Joined 2 年前
cake
Cake day: 2023年7月1日

help-circle
  • I’d rather a Mac than a Windows box. At least you get a proper shell (zsh or bash - zsh is the default now I think), python installed by default, can install package managers (macports, brew), can get coreutils, etc and most FOSS software from the Linux world runs since macs are UNIX at heart.

    I’m pretty sure cd isn’t even coreutils but implemented by shells as a wrapper for chdir/fchdir which is part of the kernel. Which has always bugged me since you can’t reliably pipe or redirect to cd since shells do things differently; it doesn’t handle stdin or the last component of a command runs in a subshell so doesn’t affect your current shell, blah blah.












  • Have you had anyone with experience with security look at this thing? There’s a lot of really questionable practices in your schedule shell scripts. I especially find how you’re handling VPN secrets kinda worrying. And the backup_challenge_clients.sh script isn’t robust at all. Your nginx config has a few bad choices like lack of try_files, the regex \.php$. It’s definitely not hardened so I hope people don’t put this Internet facing.

    I’ve spent like 5min in the GitHub to get a feel for the project maturity. Personally, I don’t think this is suitable for actual use yet.

    If you’ve not done any security assessments on your project yet, you might not want to (a) call it “Safe”box and (b) might not want to start charging money for it until you do.

    I worry you’re setting yourself up for a hard-to-shake-off embarrassment should a nasty vuln be found. Maybe a name like “selfbox” etc that drops the connotation of security would be safer.

    Edit: Kudos on the project website though! Looks fricking gorgeous.