Hmm, you have uncovered a problem with both of our ideas. Steam’s leverage is reduced after they have deposited sales proceeds, and is gone after the publisher isn’t selling games on the platform any longer.

(I’m griping about Rockstar specifically but my point is still flawed in the general case.)

Deceased users’ estates still haven’t agreed to the new terms, have they?

Now punish publishers who try to change the terms of sale after sale. “Want to play the single player game you bought a decade ago? Agree to this new arbitration clause.”

deleted by creator

Are you going to be hosting things for public use? Does it feel like you’re trying to figure out how to emulate what a big company does when hosting services? If so, I’ve been struggling with the same thing. I was recently pointed at NIST 800-207 describing a Zero Trust Architecture. It’s around 50 pages and from August 2020.

Stuff like that, your security architecture, helps describe how you set everything up and what practices you make yourself follow.

s/celebs/weebs/

Fixed :-)

I’ve been ranting about this a lot lately, but as the owner of mspencer.net (completely useless personal domain, but is 199 days older than wikipedia.org for what it’s worth)…

There is sort of a way to do that, but it’s still labor intensive so not a lot of people do it. Movements to investigate are homelab and selfhosted. Homelab equipment is old (extra power-hungry for the capability you get) or expensive. Self hosting requires a bunch of work to stand things up the way you want it.

Biggest barriers to self hosting - or hosting through your nearest nerdy relative - are the following:

Free ad-supported offerings (with the privacy and terms and conditions impacts you describe) are better and easier, so they out compete DIY options. If a nerdy family member offers to host forums and chat for your community club or whatever, the common response isn’t gratitude, it’s “That’s stupid, I’ll just use Facebook.” Without that need and attention, volunteer projects get way fewer eyeballs and volunteers are way less motivated.

Security is difficult to figure out. Project volunteers have enough on their plate just helping users get their stuff working at all. Helping novice users secure their installations is so much extra work.

Many volunteers feel taken advantage of if they produce something that could help companies make money better, when they don’t share any of the money they make through donations or support arrangements. Similarly, many open source projects get taken over by for-profit companies who diminish efforts to make their open source offerings easier to use for free. (They want companies to buy support contracts, even if it means frustrating use by private individuals without kilobucks to spare.)

Thank you for your reply, but to be clear, I’m not looking for individual details to be spelled out in comments. What you said is absolutely correct, thoughtful, and very helpful. But emotions are running a little high and I’m worried I’ll accidentally lash out at someone for helping. Apologies in advance.

But do you have any links? Beyond just the general subjects of security architecture, secure design, threat modeling, and attack surface identification, I’d love to see this hypothetical “generic VM and web application housing provider in a box” come with a reasonably secure default architecture. Not what you’re running, but how you’re running it.

Like, imagine decades in the future, internet historians uncover documentation and backups from a successful generic hosting company. They don’t necessarily care what their customers are hosting, their job is to make sure a breach in one customer’s stuff doesn’t impact any other customer. The documentation describes what policies and practices they used for networking, storage, compute, etc. They paid some expensive employees to come up with this and maintain it, it was their competitive advantage, so they guarded it jealously.

I’d want to see that, but (a) a public, community project and (b) now, while it’s still useful and relevant to emulate it in one’s own homelab.

If I can get some of that sweet, sweet dopamine from others liking the idea and wishing for my success, maybe I can build my own first version of it, publish my flawed version, and it can get feedback.

I’ve been struggling to wrap my head around a good security architecture for my mspencer.net replacement crap. Could I bug you for links?

I figured out a while ago to keep VM host management on a management VLAN, and I put each service VM on its own VLAN with heavy, service-specific firewalling and a private OS update repo mirror - but after hearing about ESXi jackpotting vulns and Broadcom shenanigans, I’ve gotten really disheartened. I’d love some safe defaults.

I think this needs to exist, but as a community supported system, not as a commercial product.

Pick a set of open technologies - but not the best, lightest weight, just pick something open.

Come up with a security architecture that’s reasonably safe and only adds a moderate amount of extra annoyance, and build out a really generic “self-hosted web hosting and VM company-like thingy” system people can rally around.

Biggest threat to this, I think, is that this isn’t the 90s and early 2000s any longer, and for a big project like this, most of the oxygen has been sucked out already by free commercial offerings like Facebook. The technical family friend offering to self-host email or forums or chat no longer gets gratitude and love, they get “why not Facebook?”

So… small group effort, resistant to bad actors joining the project to kill it, producing a good design with reasonably safe security architecture, that people can install step by step, and have fun using while they build and learn it.

Married, we both work from home, and we’re in an apartment.

First, all of my weird stuff is not between her work and living room pcs and the internet. Cable modem connects to normal consumer router (openwrt) with four lan ports. Two of those are directly connected to her machines (requiring a 150-ish foot cable for one), and two connect to my stuff. All of my stuff can be down and she still has internet.

Second, no rack mount servers with loud fans, mid tower cases only. Through command line tools I’ve found some of these are in fact capable of a lot of fan noise, but this never happens in normal operation so she’s fine with it.

Separately I’d say, have a plan for what she will need if something happens to you. Precious memories, backups, your utility and service accounts, etc. should remain accessible to her if you’re gone and everything is powered off - but not accessible to a burglar. Ideally label and structure things so a future internet installer can ignore your stuff and set her up with normal consumer internet after your business internet account is shut off.

Also keep in mind if you both switch over so every movie and show you watch only ever comes from Plex (which we both like), in an extended power outage situation all of your media will be inaccessible. It might be good to save a few emergency-entertainment shows to storage you can browse from your phone, usb or iXpand drive you can plug directly into your phone for example.

Oh boy, Michael Spencer Jr., the ghost of GitHub past! With a bio as empty as your follower count dreams, you’ve managed to accumulate a whopping three followers—congratulations on that ambitious social life. Your repos are a trip down memory lane for those still stuck in 1982, complete with assembly language nostalgia. It’s like you’re interviewing for a job in a museum of coding flops.

Your “BenedictionGame” is a masterpiece of zero stargazers—truly a testament to your extraordinary ability to create absolute nothingness in a world craving entertainment. And let’s not overlook your “CaseSwapper” that swaps cases. Wow, riveting stuff! At least your repos prove you can follow the lead when it comes to forking other projects, though I’m disappointed to see you haven’t pirated the skill to write something original.

In summary, your profile is a stark reminder that not everyone is cut out for coding fame. Maybe it’s time to swap some skills instead of just cases.

—————

Ok that’s pretty funny :-) I was hoping it would detect notable positive things and roast them like negatives, though.

Hey no botting!

NEW

Plagiarism should be part of the conversation here. Credit and context both matter.

How much stock ownership remains with the nonprofit Raspberry Pi Foundation? And will that be enough to hold off shareholder complaints that they aren’t being evil enough?

And those jobs are critical to the process of making new developers.

An important part of my education - the part that grad school can’t teach you, you have to learn it on the job - was being new and terrible, grinding on a simple problem and feeling like a waste of money. Any of the experienced guys sitting behind me could have done this thing in a few hours but I’ve been working on it for a week. “What’s the point? Any minute now they’re going to tap me on the shoulder and tell me I’m done, it’s time to go find another job.”

But that never happened.

Those early problems weren’t fun. At home I would have never chosen to work on them. I’d leave them for someone else. “But now that I’m collecting a paycheck for it, this isn’t up to me. I have to work on it. I can’t give up. I can ask for help, but I need to show my peers that I belong. I can solve difficult problems. I can persevere.”

As a mediocre professional developer, I had to struggle to learn that. I wasn’t getting far on my own, without mentorship and motivation. Homework, pursuing degrees, wasn’t getting me there. (And even now, I seem to have about two weeks of attention span, for projects at home.)

As a professional C# developer since 2012, I’d say a programmer needs four kinds of knowledge. As an organizational user of Github Copilot for a couple months, I’d say AI tools can help with one, maybe two of those.

Understanding language and syntax, so you can communicate the ideas in your head to the machine accurately: AI is fairly good at this, will certainly get a lot better.

Understanding algorithms and data structures, well enough to compare and contrast, and choose the most appropriate ones for each circumstance: AI can randomly select something, unless it’s a frequently solved problem. I don’t expect this to get better except for the most repetitive of coding tasks.

Understanding your execution environment and adapting your solutions to use it well: I don’t see the current generation of AI tools ever approaching this. I don’t think they have context for how a piece of code is used, when trying to learn from it. One size fits all is not a great approach.

Understanding your customer’s needs and specific problems, and creating products, not code. Problem domains and solutions are a business’s entire reason for existence. This is all kept confidential (and outside the reach of an AI training data set) for competitive reasons. As a human employee, you get to peek behind the curtain and learn these things yourself.

Clearly my comment annoyed you. What should I have done differently? Apart from switching away from Windows, what plan or idea should I have attempted to rally support for?

Ok that tears it. What firewall rules do I need to set so I get security updates and absolutely nothing else?

RIP to a fellow OpenVMS hobbyist.

$ SET PROC /PRIV=ALL $ REPLY /ENABLE=AFTERLIFE %OPCOM-F-VALUERR, error occurred while processing the command term “AFTERLIFE” -LIB-F-UNRKEY, “AFTERLIFE” is an unrecognized keyword $

Oh well, worth a try.