Skip to main content



The Artemis II crew, NASA astronauts Victor Glover, Reid Wiseman, and Christina Koch, and Canadian Space Agency (CSA) astronaut Jeremy Hansen, pose for a photo after a Moon tree dedication ceremony, Tuesday, June 4, 2024, at the United States Capitol in Washington. The American Sweetgum tree planted on the southwestern side of the Capitol, was grown from a seed that was flown around the Moon during the Artemis I mission.


A United Launch Alliance Atlas V rocket with Boeing’s CST-100 Starliner spacecraft aboard launches from Space Launch Complex 41 at Cape Canaveral Space Force Station, Wednesday, June 5, 2024, in Florida. NASA’s Boeing Crew Flight Test is the first launch with astronauts of the Boeing CFT-100 spacecraft and United Launch Alliance Atlas V rocket to the International Space Station as part of the agency’s Commercial Crew Program. The flight test, which launched at 10:52 a.m. EDT, serves as an end-to-end demonstration of Boeing’s crew transportation system and will carry NASA astronauts Butch Wilmore and Suni Williams to and from the orbiting laboratory. Photo Credit: (NASA/Joel Kowsky)



Technicians inside the Payload Hazardous Servicing Facility at NASA’s Kennedy Space Center in Florida prepare to rotate the agency’s largest planetary mission spacecraft, Europa Clipper, to a vertical position on Tuesday, May 28, 2024, as part of prelaunch processing. Slated to launch aboard a SpaceX Falcon Heavy rocket later this year from Launch Complex 39A at Kennedy, Europa Clipper will help determine if conditions exist below the surface Jupiter’s fourth largest moon, Europa, that could support life.


When your boss starts picking favorites



Rowan has started to pick favorites at work... and Alan is having none of it
Be our favorite at: discord.gg/vldl
Our join the favorite squad at: facebook.com/groups/vivaladirt…

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard


Waiting in the spawn queue



There is nothing as rage-inducing as waiting in the spawn queue
Get all your NPC merch at vldl.shop

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard


When the boss forces everyone into a staff party



Rowan wants to reward everyone by forcing them to go on a staff party

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard


Astronaut Eugene A. Cernan, lunar module pilot, egresses the Apollo 10 spacecraft during recovery operations in the South Pacific. U.S. Navy underwater demolition team swimmers assisted in the recovery operations. Already in the life raft were astronauts Thomas P. Stafford (left), commander; and John W. Young, command module pilot. The three crewmen were picked up by helicopter and flown to the prime recovery ship, USS Princeton.


Helen Ling was a supervisor for the computing group at NASA's Jet Propulsion Laboratory in the 1960s. She was influential in the inclusion of women in STEM positions at JPL. Ling encouraged women within the computing group to attend night school in order to obtain degrees that would allow them more professional opportunities within JPL. A pioneer for women's rights in the workplace, Helen Ling was so admired in the computing group that those who worked under her lovingly referred to themselves as "Helen's girls." Many of them went on to become computer scientists and engineers within JPL thanks to the mentorship and guidance of Helen Ling.


NASA astronaut Kate Rubins places a sample marker in the soil before collecting a sample during a nighttime simulated moonwalk in the San Francisco Volcanic Field in Northern Arizona on May 16, 2024. A sample marker provides a photographic reference point for science samples collected on the lunar surface.


Present-day Island of Hawai'i coastal flood risk, with higher risk indicated in dark blue, was modeled to help the County of Hawai'i in their shoreline setback plan. Sea Surface Temperature Anomaly data from 2022 Group for High Resolution Sea Surface Temperature Moderate Resolution Imaging Spectroradiometer (MODIS) indicate low temperatures in the East (red) to high in the West (orange). Inland, high probability locations of wetlands are shown in bright yellow and could aid in climate adaptation planning.



Nighttime, ground-level view of the Apollo 10 space vehicle on Pad B, Launch Complex 39, Kennedy Space Center. This photograph of the 363-feet tall Apollo/Saturn V stack was taken during pull back of the mobile service structure. The Apollo 10 crew was astronauts Thomas P. Stafford, John W. Young, and Eugene A. Cernan.



Degrading new workplace



Rowan has a plan to keep Alan and Adam at their desks... and it's degrading
Get your Dingo merch (including profanity free!) at vldl.shop

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard



Celebrating even the worst manager



Britt wants to celebrate Rowan on international managers day!
Get a flat clicker at vldl.shop

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard


Having a fully naked party in Baldurs Gate 3



Ben loves his companions to be very free... and naked...
Cover yourself up at vldl.shop

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard
#BG3
in reply to VLDL Videos

VLDL Videos tagged VLDL Videos's status with #BG3


Having a fully naked party in Baldurs Gate 3



Ben loves his companions to be very free... and naked...
Cover yourself up at vldl.shop

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard

#BG3


Who is the Windows Administrator?



Alan wants to print in colour, but to do that, he has to see the administrator
Get the Administrators favorite merch: vldl.shop
Featuring John Callen!

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard


The tension of picking your party in BG3



Picking a party in Baldur's Gate 3 means breaking a few hearts

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard
#BG3
in reply to VLDL Videos

VLDL Videos tagged VLDL Videos's status with #BG3


The tension of picking your party in BG3



Picking a party in Baldur's Gate 3 means breaking a few hearts

SUPPORT US ON PATREON - bit.ly/36Hg7ZY

ALL SOCIALS - linktr.ee/vldl
TWITCH - twitch.tv/team/vldl
MERCH - vldl.shop
SONGS - bit.ly/2OBeB4O

            SERIES PLAYLISTS

Epic NPC Man: bit.ly/NPCman
Bored: bit.ly/VLDLbored
PUBG Logic: bit.ly/PUBGlogic
FPS Logic: bit.ly/FPSlogic
Souls Logic: bit.ly/Soulslogic
Music Videos: bit.ly/VLDLmusicvids
Wildcards: bit.ly/VLDLwildcard

#BG3

in reply to Gerhard Hallstein

Ich habe Deine Frage nicht ganz verstanden. Man benötigt doch nur einen Spitznamen, eine Mailadresse und ein Passwort für Friendica und andere Dienste hier im Fediverse, deswegen war ich etwas verwirrt.
in reply to Gerhard Hallstein

@Michael Vogel Da habe ich wohl missverständlich oder zu umständlich formuliert - sorry. Meine Frage hat Du beantwortet.



"For the girls or women in science — or in any profession or job — opportunities are more abundant than they were previously. Sometimes you need to take bold steps. Just a little push, and then you will get there." — Dr. Yihua (Eva) Zheng, Space Physics and Space Weather Scientist, Heliophysics Science Division, NASA's Goddard Space Flight Center


@helpers I updated my OS from Debian 11 to 12 (finally) and when I did, apache2 broke. I've got it reinstalled, but I'm 99% certain it's missing required modules. (see: social.jlamothe.net for the error I'm encountering). Is anyone able to help me hunt down which modules I'm still missing?
in reply to Hypolite Petovan

@Hypolite Petovan @Jonathan Lamothe It's working!

Turns out I'd already fixed the problem, I just had to restart Apache.

It also fixed the problem with my Nextcloud instance!



!Friendica Support

Funktioniert die libranet.de Domain weiterhin oder muss ich mich dann bei forum.friendi.ca neu registrieren?

Wird das Twitter plugin irgendwann wieder funktionieren? Man kann ja zumindest die Posts fetchen:
nitter.poast.org/elonmusk

in reply to Mister Frety

Posten nach Twitter funktioniert, das Holen von Beiträgen nicht. Ich persönlich werde auch keine Zeit darin investieren zu schauen, wie es bei Nitter geht.


@Friendica Support @Michael Vogel Auf der Seite zum Wechsel des Kontos werden in Gerhards Gedankenbuch oft Neueingänge angezeigt, die es gar nicht gibt. Sie werden nur auf dieser Seite angezeigt, aber nicht im Gedankenbuch selbst.

Ist das ein Bug oder hat oder welchen Hintergrund gibt es dafür?


in reply to Gerhard Hallstein

Das eine ist eine Einstellung, damit der Kontakt nicht auf der Netzwerkseite erscheint. Das andere ist eine Liste mit Kontakten. Ich sehe da nicht die Gemeinsamkeit.


Guten Morgen @Friendica Support mir ist gerade aufgefallen, dass diese Friendica Instanz (anonsys.net) nicht mehr im Verzeichnis auftaucht: dir.friendica.social/servers/d…
Hat das einen bestimmten Grund?
in reply to Tuxi ⁂

@Tuxi :Friendica: 🐧 ✅ I know. But wouldn't it be a nice feature, if the admin would be informed by DM, when its site is kicked or the health score is updated?


Safety is important, no matter where you're viewing the eclipse. NASA astronauts aboard the International Space Station show off their eclipse glasses, which allow safe viewing of the Sun during a solar eclipse.


Two full-scale development model rovers that are part of NASA's CADRE (Cooperative Autonomous Distributed Robotic Exploration) technology demonstration drive in the Mars Yard at the agency's Jet Propulsion Laboratory in Southern California in August 2023. The project is designed to show that a group of robotic spacecraft can work together as a team to accomplish tasks and record data autonomously – without explicit commands from mission controllers on Earth.


Fediverse | Probleme bei der Federation


Es gibt im Fediverse einige Newsbots deren 'Anrisse' bei mir scheinbar ohne Link zum Orginalbeitrag sind. Nehmen wir zum Beispiel diesen Beitrag. Bei mir (Friendica) sieht er so aus:

Sprich es gibt nur einen kurzen Textanriss und ansonsten gar nichts. Gehe ich dann auf den Orginalbeitrag (ebenfalls Friendica), so sieht es so aus:

Nun stellt sich die Frage wo unterwegs das Bild als auch der Link auf der Strecke geblieben sind. Liegt es daran das ich die Vorschau für Links deaktiviert habe? Wenn ja, dann müsste ja doch trotzdem irgendwo der entsprechende Link im Beitrag sein, oder sehe ich das falsch?

Achso, der Vollständigkeit halber findet man hier auch noch die verlinkte Seite bei DW.

#Frage #Fediverse #Friendica #News #LInks #Sascha #2024-03-24 @Friendica Support

in reply to Sascha 😎 🏴 ⁂ (Fediverse)

PR ist erstellt: github.com/friendica/friendica…

Nur ein kleiner Hinweis zum Betreff: "Probleme bei der Federation" wären es, wenn Beiträge oder Kommentare nicht verteilt würden. Das hier war ein Darstellungsproblem.

in reply to Michael 🇺🇦

Für mich wäre es eine Verschlechterung, wenn der Link zusätzlich angezeigt wird, ohne der nicht irgendwann gekürzt wird. Link sind teilweise so lang, wie ein Blogbeintrag. Solche Beiträge sind unbrauchbar.

Wenn sich die PR nur auf Beiträge ohne Vorschau bezieht, ok.

in reply to Matthias

Der Link wird nur angehängt, wenn er nicht schon irgendwo im Beitrag steckt und wenn ausgewählt wurde, dass man keine Vorschau haben möchte.

Es sieht jetzt so aus:

in reply to Matthias

Ich danke Euch beiden. War halt komisch bei diesen ind anderen Newsbots immer nur den Anriss und sonst nichts zu haben. Ich wünsche Euch nen schönen Sonntag. :-)
in reply to Sascha 😎 🏴 ⁂ (Fediverse)

Das ist der Unterschied. Der Link wird bei Mastodon immer mitgeliefert. Die brauchen den, weil der Content nicht on the fly erzeugt wird, sondern irgendwo im Hintergrund.


@Friendica Support @Michael Vogel Beim Aufruf meines Kontos gerhardsgedankenbuc@squeet.me werden nach wie vor Aktivitäten angezeigt, die es nicht gibt.
Gibt es eine Möglichkeit, diesen Fehler dauerhaft zu beheben?


@Friendica Support Wenn ich eine Email-Benachrichtigung über eine neue Aktivität in meinem Blog gerhardsgedankenbuc@squeet.me bekomme und in dieser Email unten auf den notify-Link klicke, erhalte ich diese Meldung. Ist das Absicht oder ein Bug?
in reply to Gerhard Hallstein

@Michael Vogel Sowohl mein oldie- wie mein Blog-Konto werden beide unter den Daten des oldie-Kontos geführt. D.h. im Umkehrschluss, dass ich auch in meinem Blog mit den Daten des oldie-Kontos angemeldet bin.
Wie kann ich dieses Problem lösen?
in reply to Gerhard Hallstein

Du schaltest ja zwischen den Konten mit Hilfe des Menüpunktes "Nutzerkonten" um. Wenn oben rechts "Oldie" steht, klappen die Links auf Benachrichtigungen für "Oldie" und wenn oben rechts der Blog steht, klappen Links auf Benachrichtigungen des Blogs.


@Friendica Support Bei meinem Gedankenbuch wird schon seit einigen Wochen ein neuer Kommentar angezeigt, obwohl es keinen gibt. Welchen Grund könnte es dafür geben?
in reply to Gerhard Hallstein

Ich habe jetzt mal alle Benachrichtigungen als gelesen gekennzeichnet und der genannte Hinweis ist verschwunden. Ich konnte allerdings nicht nachvolllziehen, welchen Kommentar o.ä. ich übersehen haben sollte.
in reply to Gerhard Hallstein

Heute trat dieser Fehler erneut auf: Es wurden 5 Benachrichtigungen in dem o.g. Screenshot angezeigt, aber keine oben im Blog bei den Benachrichtigungen (Glockensymbol). Ich habe wieder alle Benachrichtigungen als gelesen gekennzeichnet, ohne zu wissen, ob ich möglicherweise Kommentare o.ä. übersehen habe.

Könnte das mal jemand prüfen?
@Michael Vogel ?




Hilfe | Friendica: Probleme beim Folgen eines anderen Friendica Accounts


Hallo Zusammen, ich habe das Problem das ich wenn ich von meinem Friendica Account @Raven 🏴 (social.aghd.org/profile/raven) dem Friendica Account @Sascha 😎 🏴 (loma.ml/profile/sascha) zu folgen folgende Meldung bekomme:

Von @Sascha 😎 🏴 kann ich dem Account @Raven 🏴 ebenfalls nicht folgen. Auffällig ist dabei das dessen Profilbild nicht korrekt angezeigt wird und auch die aktuellen Beiträge nicht

Versuche ich den Account dann zu folgen kommt folgendes:

Nach einigen Tests scheint das Problem vor allen im Zusammenspiel von loma.ml und social.aghd.org zu liegen.

Wo könnte das Problem liegen?

Tags: #Frage #Friendica #Accounts #Folgen #Probleme #Raven #2024-02-03 @Friendica Support

in reply to Raven 🏴

@Raven 🏴 @Sascha 😎 🏴 wie lange ist denn die aghd-instanz schon online? evtl. warten bis alle worker aufgaben fertig sind und aktuelle instanz-daten alle vorliegen. ich weiß es nicht, rate nur
in reply to xy..

Die aghd-Instanz läuft jetzt seit einen knappen Monat. Im Worker sind noch ein paar Sachen, aber nicht viele.


Wert von "Lebensdauer nicht angeforderter Beiträge" lässt sich nicht ändern. Ich möchte den Wert von 7 auf 1 stellen, allerdings wird der geänderte Wert nicht übernommen. Beim Speichern selber erscheint auch keine Fehlermeldung. Verwendet wird die aktuelle Entwicklerversion.
@Friendica Support
in reply to Roland Häder

@Roland Häder
Aufgrund deines Kommentars habe ich jetzt mal den Browsercache gelöscht und den Browser neu gestartet. Jetzt funktioniert es. Seltsam.

in reply to utopiArte

In your Markdown you haven't provided the alt text, but the title. See here: markdownguide.org/basic-syntax…

The alt text has to be between the two []. The text after the image link is the title. We don't support a separate title.

in reply to Michael 🇺🇦

In other words, to be visible on firendica I'll have to use the brakets that Diaspora uses for text that is displayed if the image dosen't show up and there for post the text two times:
🤔
![Vistenkarte mit Wofgang Neuss, dem Man mit der Pauke. Wofgang lehnt an seiner grossen Pauke, hält delikat seinen Schlegel in der Hand und schaut leicht säuerlich nach links oben. In grossen Lettern steht geschrieben: Gegen Klima-kleber hetzen? Warum nicht? Lieber asozial als gar nicht regieren! Auf den Trommelfell seiner Pauke ist ein nicht erwähnenswerter Politiker zu sehen.](https://tupambae.org/photo/202597926365a61188ad34c262410425-1.jpg " Visitenkarte mit Wofgang Neuss, dem Man mit der Pauke. Wofgang lehnt an seiner grossen Pauke, hält delikat seinen Schlegel in der Hand und schaut leicht säuerlich nach links oben. In grossen Lettern steht geschrieben: Gegen Klima-kleber hetzen? Warum nicht? Lieber asozial als gar nicht regieren! Auf den Trommelfell seiner Pauke ist ein nicht erwähnenswerter Politiker zu sehen. " )
in reply to utopiArte

The first text is the text that screenreaders are using. So for accessibility reasons the first one has to be set. The second text is just decoration. it is not needed for accessibility.
Unknown parent

friendica - Link to source
utopiArte
it works ..


Friendica | Könnte man da bitte ein wenig mehr Abstand einbauen?

Wäre es möglich beim Dialog zur Bildbearbeitung zwischen dem Berechtigungslink und dem senden Button mehr Abstand einzubauen damit man beim Smartphone nicht regelmäßig das Falsche erwischt? Generell wäre es gut für den Bereich eine Überarbeitung ins Auge zu fassen.

Bildbearbeitungsdialog Friendica

#FrFriendica #Bilder #Bildbearbeitung #Bildbearbeitungsdialog #Frage #2023-12-19 @Friendica Support

in reply to Raroun

@Raroun Danke Dir! :-) Es ist halt alles mit der Maus oder dem Touchpad recht gut bedienbar. Das Problem ist oft die Handhabung auf Smartphone und Tablet. Besonders wenn man solche Wurstfinger wie ich hat.


Implications of access by the user www-data to all friendica folders


@Friendica Support

Hi there,
the friendica helpers page describes the installation process of friendica as follows:

/help/Install: wrote:

The Linux commands to clone the repository into a directory "mywebsite" would be
git clone https://github.com/friendica/friendica.git -b stable mywebsite
cd mywebsite

bin/composer.phar install --no-dev

Make sure the folder view/smarty3 exists and is writable by the webserver user, in this case www-data

mkdir -p view/smarty3
chown www-data:www-data view/smarty3
chmod 775 view/smarty3

Get the addons by going into your website folder.

cd mywebsite

Clone the addon repository (separately):

git clone https://github.com/friendica/friendica-addons.git -b stable addon


askubuntu.com: wrote:

What is the www-data user?
askubuntu.com/questions/873839…
The web server has to be run under a specific user. That user must exist.

If it were run under root, then all the files would have to be accessible by root and the user would need to be root to access the files. With root being the owner, a compromised web server would have access to your entire system. By specifying a specific ID a compromised web server would only have full access to its files and not the entire server.

I guess this observation goes both ways, a compromised friendica instalation get's access to all the friendica folders if I choose to first create/activate the www-data user, than create the friendica installation folder structure, than git clone friendica, than create the smarty3 folder and ultimately do the git clone of the addon folder as described here:
tupambae.org/display/0ac89072-…
The order in which the creation of www-data related folders in the above case is described makes all folders and files in the friendica directory belong to www-data.
In the friendica help description first comes the git-clone, than the the smarty3 folder part than the addon git-clone. Actually I guess that last part would make the addon folder belong to www-data too if I run one command after another. Is that intended?

I wonder if this could have some kind of security implications.
I guess www-data is somehow the friendica site and has permissions to do "what ever it wants" (-> "writable by the webserver user") with all the folders in the friendica directories if it's the owner of them.


@TupambAdmin [stable]

in reply to utopiArte

@utopiArte For a Friendica node to work properly, the web server user (here www-data) needs to have read access to the whole Friendica folder structure and write access to a few important places, including the smarty3 cache folder. The simplest way to achieve this is to grant ownership to the whole Friendica file tree to www-data.

The security implication is that if someone ever gains unauthorized access to www-data, they can indeed do "whatever they want" with your Friendica install, including deleting files, adding malware to Friendica pages, access the whole Friendica database including the user list, the private post and messages.

And if you host multiple websites on the same server, they can also access and tamper with those if their file trees are owned by the same user.

It's a big "if" though, as on Debian-based distribution like Ubuntu, the www-data user doesn't have shell access, meaning that you can't open a remote shell using this user. Any unauthorized access has to go through the actual hosted applications. For example WordPress is a popular unauthorized access vector for malicious actors because it's so popular and people don't always update their software timely.

I don't think Friendica is very secure, but it is a low-profile target and we do act quickly when we receive security reports, even releasing hot fix versions when the scheduled release date is a little to far.

You can make your install marginally more secure by only giving access to the file tree through group permissions and only giving read/traverse rights by default, granting write rights only for the specific locations that need it. This way, in case of a malicious access, it will prevent attackers from inserting malicious code in your Friendica node pages, but that's about it.

in reply to Hypolite Petovan

> granting write rights only for the specific locations that need it

What folders would that be?

What I have seen so far that would be:
/storage
/view/smarty3
and
/config
but only while installing local.config.php

Something I don't understand is why I do have a few folders in:
/view/smarty/compiled
that belong to the user root.
How is that possible?
How can friendica create folders as and/or for root?

What should I expect to happen if I just delete those folders, or even delete the complete /compiled folder. I guess friendica would start from there to create the folder compiled and subfolders as needed?

I ask because there are those subdirectories belonging strangely to root and one of my issues is that when I switch to the theme FRIO I have no access anymore to the settings of that respective profile, not even to change back to VIER. That renders that profile nearly useless and I'm trying to get around that problem.

in reply to utopiArte

@utopiArte That's a good list of exceptions.

Regarding the root-owned folders, it would prevent www-data from reading the cached template files and subsequently display the pages that uses the specific templates in this folder.

You should restore recursive www-data ownership to this or these folders. Please let me know if you need an example of a command line to do so.

in reply to Hypolite Petovan

I guess to just change all the folders/subfolders and files regardless of their ownership that would be:

rootname@VPShosting:/var/www/html/view/smarty3/# chown -R www-data:www-data compiled

in reply to Hypolite Petovan

Just checked the settings page of one of the profiles in question and yes, that fixed it.
thx
👍

(again, how could this possibly happen, shouldn't we look for some bug somewhere or do we just assume some quantum entanglement?)

in reply to utopiArte

result:

What I don't get is where these ownership settings came from.
They were not even from a specific day or had anything specific in common:
tupambae.org/display/0ac89072-…


Just checked all the 13 of 220 folders that were created as belonging to user and group root and that I consider shouldn't exist as owned by root i the folder /smarty3.

In general terms speaking I couldn't find a common property.

They refer to posts or replies by three different users.

Most refer to one specific post.

Two create a page:
Not Found
The requested item doesn't exist or has been deleted.
Request: XYZ

All were created with the theme VIER.


in reply to utopiArte

@utopiArte @Hypolite Petovan this is most likely just some goof while doing something minor that you wouldn't have even connected to this at the time.

No amount of proficiency and watchfulness eliminates user error, it just becomes increasingly obscure.

in reply to Shiri Bailem

Even tho there have been some trouble while setting up this installation what calls my attention ist that those folders had kinda random different dates of creation:

drwxr-xr-x 3 root root 4096 Nov 12 04:35 00
drwxr-xr-x 4 root root 4096 Nov 16 02:10 30
drwxr-xr-x 3 root root 4096 Nov 17 19:35 3e
drwxr-xr-x 3 root root 4096 Nov 11 01:57 49
drwxr-xr-x 3 root root 4096 Nov 16 22:25 4e
drwxr-xr-x 3 root root 4096 Nov 11 01:55 59
drwxr-xr-x 3 root root 4096 Nov 14 11:10 90
drwxr-xr-x 3 root root 4096 Nov 21 22:50 a3
drwxr-xr-x 3 root root 4096 Nov 23 00:45 a4
drwxr-xr-x 4 root root 4096 Nov 23 19:15 ae
drwxr-xr-x 3 root root 4096 Nov 23 20:35 b4
drwxr-xr-x 3 root root 4096 Nov 16 00:53 bf
drwxr-xr-x 3 root root 4096 Nov 14 11:10 e2
in reply to utopiArte

@utopiArte @Shiri Bailem Cache folders are created as needed. Since they are based on the 2 first or 2 next characters in the hash of the cached template, their distribution is supposed to be random. Not every page gets called every time, and then when you update your node some templates change and their hash with them.
in reply to Hypolite Petovan

Like to say this started with one folder being owned by root and from there others were created with the same ownership?
in reply to utopiArte

@utopiArte @Hypolite Petovan it might be helpful to note: only root can create folders owned by anyone else, so those folders had to be created from friendica or some part of it running as root at the time they were created, this is why I said it was likely user error
in reply to Shiri Bailem

That's what astonishes me.

My access is only via console SSH to the VPS and that shouldn't create any kind of cross implications with the firefox webbrowser that accesses the friendica installation.

Also apparently the installation itself was created the 8th of November, the first folder apparently the 11th of November so there was no relation to that.

If friendica is able to create a folder and files as root that's kinda scary isn't it?

in reply to utopiArte

@utopiArte @Hypolite Petovan it's not able to, and if it was it would be considered a massive linux security bug rather than a friendica bug.

SSH and VPS mean nothing for this situation, you likely just ran something with sudo at some point.

in reply to Hypolite Petovan

> That's a good list of exceptions.

In theory I could there for run the following commands to set all folders except /storage and /view/smarty3 to root:

set ownership of everything recursively to root:
rootname@VPShosting:/var/www/# chown -R root:root html

set ownership of storage and smarty3 recursively to www-data:
rootname@VPShosting:/var/www/html/# chown -R www-data:www-data storage
rootname@VPShosting:/var/www/html/view/# chown -R www-data:www-data smarty3

The change of ownership wouldn't affect the specific read/write permissions of files and folders and www-data would have only access to the folders needed.

right?

in reply to utopiArte

@utopiArte Indeed, it is separate. Please be on the lookout in your log for message like "Can't open file: Access denied" in case we missed a crucial place.
in reply to Hypolite Petovan

I ended up doing the following:

First I created a backup folder of the existing html folder and subdirectories:

root@VPShosting:/var/www# cp -r html html_01.bak

By default that created a copy with all files and folders owned by root.

Than I changed the ownership of storage and smarty3 to www-data:

root@VPShosting:/var/www/html_01.bak# chown -R www-data:www-data storage

Screen of the new user and group owner ship setting of the /html folder

root@VPShosting:/var/www/html_01.bak/view# chown -R www-data:www-data smarty3

Screen of the new user and group owner ship setting of the /view folder

Once everything looked "fine" I moved the existing html folder to a new name.

root@VPShosting:/var/www# mv html html_www-data_old

By moving [mv] instead of copying [cp] the ownership of files and folders aren't affected. Than I moved the copy with the new ownership settings into place:

root@VPShosting:/var/www# mv html_01.bak html

Well see how this setup behaves.
In any case I'll have the old version at hand to change to it if necessary.

in reply to utopiArte

@utopiArte security implications are minor, mostly because they can only edit the thing they've already hacked into.

But if that's a particular concern, you should be able to make the entire directory read-only as I don't believe friendica edits any of those files after initial setup (since all the edits are in database, or a separate storage folder if you're using the folder storage backend)

The writable in your quoted instructions is for the setup process while logged in under that user, so of course it'll need write to be able to download files and install them in the webserver directory. But there's no indication that it's needing write past that.

This website uses cookies to recognize revisiting and logged in users. You accept the usage of these cookies by continue browsing this website.