jmealo

Can we use PostrgreSQL's row-level-security to enable arbitrary query execution security in secure multi-tenant web applications?

Can we break out and access another tenants information?

No, this is handled using schemas, ownership and roles (users). Using RLS does not impact leaking data between tenants. This allows us to give out SQL accounts that can run arbitrary queries without leaking data between tenants.

How can we protect against role or privileges escalation within a tenant?

Consider an application that has 3 user types (roles):

wojons

apt-get install -y libreadline-dev libncurses5-dev libpcre3-dev \
    libssl-dev perl make build-essential



wget https://github.com/openresty/stream-lua-nginx-module/archive/v0.0.1.tar.gz \
    -O /tmp/stream-lua-nginx-module-0.0.1.tar.gz
    
mkdir /tmp/stream-lua-nginx-module-0.0.1
tar xzvf /tmp/stream-lua-nginx-module-0.0.1.tar.gz -C /tmp/stream-lua-nginx-module-0.0.1

Aghassi

version: '2'
services:
    plex:
        image: linuxserver/plex
        container_name: plex
        volumes:
            - /path/to/plex/config:/config
            - /path/to/plex/Movies:/data/movies
            - /path/to/plex/Shows:/data/tvshows
            - /path/to/plex/transcode:/data/transcode

saurabhnanda

Tuning ZFS + Postgres to outperform EXT4 + Postgres

Please refer to ZFS 2-3x slower than EXT4 to see how ZFS defaults + Postgres defaults severely underperform EXT4 defaults + Postgres defaults (and also to know more about the system on which these benchmarks were performed). This page documents how to tune ZFS + Postgres to give better performance for the tpcb-like benchmark.

BIG FAT WARNING

Please do not copy these settings blindly because I am myself not clear on why/how these settings had the impact they did. For example, I cannot explain why full_page_writes=off independently did not give that much boost, nor did an optimized PG configuration. However, putting both of them together gave a 2-4x boost compared to baseline numbers.

Benchmark results

Alby-o

// imgLib -> Image package from https://pub.dartlang.org/packages/image
import 'package:image/image.dart' as imglib;
import 'package:camera/camera.dart';

Future<List<int>> convertImagetoPng(CameraImage image) async {
  try {
    imglib.Image img;
    if (image.format.group == ImageFormatGroup.yuv420) {
      img = _convertYUV420(image);
    } else if (image.format.group == ImageFormatGroup.bgra8888) {

slykar

Introduction

Docker.app will complain about incompatible processor, so we will use Docker Machine.

Instalation

Download Docker for Mac (Docker.app). It contains some binaries that are necessary.

brew install virtualbox docker-machine

davidmankin

This page documents what to do when you hit Issue #4385 where you get the error "Cannot mount NetworkVolume at /data/mounts/NetworkVolume because it is not empty".

(Steps derived from helpful comment by Kjeldgaard here: home-assistant/supervisor/issues/4358#issuecomment-1818009197)

One time Setup:

Install Advanced SSH & Web Terminal add-on.

jmealo

brew install sleepwatcher
# write restart_apps.sh to ~/.wakeup
chmod +x ~/.wakeup
brew services start sleepwatcher

# your mileage may vary getting sleepwatcher to run the script, but, the script should work if executed manually