but I assume that it sets legal precedent for all.

Other courts might look at it for inspiration, but since Germany has a civil law system (as opposed to the common law system that is usual in English-speaking countries), prior rulings do not really have as much significance as “legal precedent” here.

They should fix their broken resolvers then, that’s not for me to work around. I don’t think it’s actually a big problem in practice though, because

1. my primary nameserver is actually fairly reliable, and
2. it looks like the nameservers in the NS query are in a randomized order (until the response is cached, of course)

That’s fair. Though you should consider that it’s really easy to set up secondary nameservers as a mirror (ns-global, for example, offers such a service). So your own reliability matters less in the end.

On the other hand, Cloudflare is kind of becoming the internet with all the centralization.

Yup. That’s the main reason I avoid using them.

deciding whom to choose for nameservers

This is tangential to your actual question, but why not host your own? I’ve had good experiences with self-hosting an authoritative nameserver for my domains. I personally use BIND (named), but I know someone who does the same with nsd and that also works very well.

edit: actually, might as well add the reasoning behind my choice of TLD, since it’s pretty simple. It’s a .de domain because I’m in Germany :)

looks like it’s the latter for lemmy-ui. (And the former for mlmym, which is my default frontend.)

I would be very surprised if the lemmy server would sanitize comment bodies, as they are just supposed to be markdown input. That’s the responsibility of the frontend, like lemmy-ui. Depending on the markdown library used, it could either just remove any HTML elements or escape them.

I guess we could try it out right here:

<script>alert(“XSS”)</script>

On residential connections, that’s probably the case, yes. I’m hosting it on a VPS though and have had no problems with blocked ports so far. I imagine it depends on the provider?

I’m not too concerned, for example, if they have to check their spam folders. As long as the email still lands.

In that case, it really isn’t that much of a hassle. A basic mail system isn’t that complicated to set up (just make sure you have proper authentication and such, don’t host an open relay!). I actually did this not too long ago, using maddy, which unlike the traditional postfix+dovecot setup (which I had also been looking into) means you don’t even have to host separate services for SMTP and IMAP, and it also automates most additional things that are necessary nowadays for you, like TLS, DKIM, DMARC, and so on. Not quite everything though, there’s still stuff needed to do manually, mostly to set the SPF and DMARC records in the DNS, but it’s been working really well so far.

And really, the only mail provider you have to worry about for putting your mails into spam is gmail. They’re the worst. (maybe microsoft-hosted outlook too, but I haven’t encountered anyone using that)

No? If you want to resolve this URI, you have to follow the redirect, there’s no way around it. Requesting it from google and looking at the Location header is following the redirect.

I mean, I agree that one should drop google and that this is probably just another thing they do to track people, but that’s not what I meant with that comment.

The real URL is in the Location header on /goto. Request that URL. Do not follow the redirect.

…but that’s how you follow a redirect?

Unrelated to the actual anti-bot topic discussed here, but I would just like to mention this point:

PROTOCOL = http+unix: because UNIX sockets are said to be faster locally but also because this avoids the painful management of ports. Also feels safer [as] there is no way to connect from outside.

This is really underrated. I try to use this for all the server software I host, and not having to manage ports is absolutely great, along with knowing that nothing can connect to the service internally when it’s not supposed to.

Except I actually go a step further and use systemd’s socket activation feature, which has a few additional benefits (like seamless restarts, no need for CAP_NET_BIND_SERVICE (my webserver and reverse proxy runs as a completely unprivileged user!), only starting the service once there is a request (this one is admittedly less useful), and having a quick overview of bound ports and Unix socket paths listed in the .socket file). Unfortunately, most programs need to be patched to support this, including forgejo (outdated codeberg link here because I had to set the forgejo repository on my own code forge to private earlier today because of scrapers…).

yup:

(-27)^2/3 = ((-27) ^ 2) / 3

-27^2/3 = (-(27 ^ 2)) / 3

The reason is that you almost always want the negation to happen after the exponentiation, because it otherwise wouldn’t have any effect (at least when the exponent is even).

-27^2/3 would come out to a different number, because the exponentiation has a higher precedence than the negation

Yes, there’s an “enable JXL (JPEG XL) support” toggle in the settings (tabs and browsing → media on librewolf (which is what I use too), or in ‘firefox labs’ on normal firefox).

It does seem to be animated when I view the file in firefox. That doesn’t have to mean it works when embedded on webpages though, but I guess there’s an easy way to test that :)

Interesting, that’s much more sophisticated than my setup (though to be fair, I host my services on a rented VPS instead of home)!

The issue only occurs with my externally-facing DNS, which is needed to, for example, to reach my Lemmy backend instance (lemmy.pootis.network) and the pictrs deployment. But yeah, internal DNS works perfectly for me and it easily survives a node failure.

Could still set up a recursive resolver for external DNS, but I guess that wouldn’t help other people who use a bad resolver. Tricky situation.

But even if I query 1.1.1.1 directly for my-website’s record, it just doesn’t work most of the time because the resolver pins itself to ns1 which is currently failing, or it selects ns1 and does not even care to try ns2.

That sounds bad. They really shouldn’t do that.

moving my DNS infra somewhere else (Cloudflare, for example)

And it would also mean this isn’t a solution either. If the problem is on the resolvers’ side, moving to a different DNS hoster would not change anything. Hm. And the other two potential solutions you’ve listed would be extremely overkill for this use case…

Personally, I only host one authoritative nameserver and do redundancy by using some free secondary DNS services (although a friend has also recently set up an authoritative nameserver, so maybe we’ll host secondary DNS for each other in the future). I haven’t encountered this issue before, but my server also hasn’t been down a lot.

There’s a lot of custom machinery that keeps my workloads running and accessible after a node failure, but all of this becomes completely moot when authoritative DNS is the bottleneck.

If it’s only necessary for your own stuff, maybe you should set up a local DNS resolver that works correctly which your services can use?

To be fair, I’ve heard it from somewhere else too. I’ll see if I can find a source.

It’s best not to use multiple ad blockers at the same time. They’ll conflict with each other and you’ll be worse off. uBO alone is probably enough.

Ah, didn’t expect you to already know qobuz 🙃

But yeah, that’s definitely a problem. I remember them sending the email where they announced this could happen now (although weirdly enough, they never sent an email for when purchased items were taken down any time after that again), and had it happen a few times as well. Luckily, I’ve also saved everything locally, so I haven’t lost anything. Still annoying. Also sometimes, an album that’s suddenly gone just seems to reappear a few months later, as if they were just reorganizing their library, but really, I have no idea what’s going on.